theory Invoke_C

lemma resetUntypedCap_ccorres:
  notes upt.simps[simp del] Collect_const[simp del] replicate_numeral[simp del]
        untypedBits_defs[simp]
  shows
  "ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
     (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap o cteCap) slot
         and (\<lambda>s. descendants_of' slot (ctes_of s) = {}))
     (UNIV \<inter>  {s. srcSlot_' s = Ptr slot})
     []
     (resetUntypedCap slot)
     (Call resetUntypedCap_'proc)" using [[ceqv_simpl_sequence = true]] supply if_cong[cong] option.case_cong[cong] apply (cinit lift: srcSlot_') apply (simp add: liftE_bindE getSlotCap_def
                    Collect_True) apply (rule ccorres_getCTE, rename_tac cte) apply (rule ccorres_move_c_guard_cte) apply (rule ccorres_symb_exec_r) apply (rule_tac xf'="prev_cap_'" in ccorres_abstract, ceqv) apply (rename_tac prev_cap) apply (rule_tac P="ccap_relation (cteCap cte) prev_cap"
       in ccorres_gen_asm2) apply (csymbr | rule ccorres_Guard_Seq[where S=UNIV])+ apply (rule_tac P="isUntypedCap (cteCap cte)
             \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits
             \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1)
             \<and> is_aligned (of_nat (capFreeIndex (cteCap cte)) :: addr) minUntypedSizeBits
             \<and> capBlockSize (cteCap cte) < 2 ^ word_bits"
       in ccorres_gen_asm) apply clarsimp apply (frule(1) isUntypedCap_ccap_relation_helper) apply (clarsimp simp: shiftr_shiftl1) apply (rule ccorres_Cond_rhs_Seq) apply (frule of_nat_0, simp add: word_bits_def) apply (simp add: unlessE_def) apply (rule ccorres_split_throws) apply (rule ccorres_return_CE, simp+) apply vcg apply clarsimp apply (clarsimp simp: unat_of_nat32) apply (frule of_nat_gt_0) apply (simp add: unlessE_def) apply (simp add: hrs_htd_update) apply (rule ccorres_Guard_Seq[where S=UNIV])? apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow) apply (rule_tac idx="capFreeIndex (cteCap cte)" in deleteObjects_ccorres[where p=slot]) apply ceqv apply clarsimp apply (simp only: ccorres_seq_cond_raise) apply (rule ccorres_cond[where R="\<top>"]) apply (clarsimp simp: Kernel_Config.resetChunkBits_def) apply (simp add: word_less_nat_alt unat_of_nat32 from_bool_0) apply blast apply (simp add: liftE_def bind_assoc shiftL_nat unless_def
                         when_def) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_split_nothrow[where xf'=xfdc and r'=dc]) apply (rule ccorres_cond2[where R=\<top>]) apply (simp add: from_bool_0) apply (ctac add: clearMemory_untyped_ccorres[where ut_slot=slot]) apply (rule ccorres_return_Skip) apply ceqv apply (rule ccorres_rhs_assoc2)+ apply (rule ccorres_split_nothrow_novcg) apply (rule_tac cap'="cteCap cte" in updateFreeIndex_ccorres) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: typ_heap_simps' cap_get_tag_isCap
                             dest!: ccte_relation_ccap_relation) apply (drule(1) isUntypedCap_ccap_relation_helper)+ apply (rule exI, strengthen refl, simp) apply (simp only: t_hrs_update_use_t_hrs mex_def meq_def) apply blast apply ceqv apply (rule ccorres_return_CE'[unfolded returnOk_def o_apply], simp+) apply wp apply (simp add: guard_is_UNIV_def) apply wp apply simp apply (vcg exspec=cleanCacheRange_RAM_preserves_bytes) apply (rule_tac P="resetChunkBits \<le> capBlockSize (cteCap cte)
             \<and> of_nat (capFreeIndex (cteCap cte)) - 1
                 < (2 ^ capBlockSize (cteCap cte) :: addr)"
           in ccorres_gen_asm) apply (elim conjE) apply (simp add: whileAnno_def) apply (rule ccorres_Guard_Seq ccorres_rhs_assoc)+ apply csymbr apply (simp add: reset_name_seq_bound_helper2 word_sle_def word_sless_def
                        msb_big linorder_not_le word_bits_def word_of_nat_less
                        reset_name_seq_bound_helper2[simplified simp_thms]
                        Collect_True) apply ((rule ccorres_Guard_Seq[where S=UNIV])+)? apply (rule ccorres_add_returnOk) apply (rule ccorres_splitE_novcg) apply (rule_tac P="capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte))
                 (capFreeIndex (cteCap cte)) - 1"
               in ccorres_gen_asm) apply (rule_tac P="(\<exists>s. valid_cap' (cteCap cte) s)
                \<and> \<not> capIsDevice (cteCap cte)" in ccorres_gen_asm) apply (rule_tac yf="\<lambda>ptr. ptr - (capPtr (cteCap cte))"
                      and P="\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s"
                      and F="\<lambda>n b idx. cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte'
                                  = (cteCap cte)\<lparr> capFreeIndex := idx' \<rparr>
                              \<and> idx = (getFreeRef (capPtr (cteCap cte)) idx') - 1
                                  && ~~ mask resetChunkBits) slot
                          and invs'
                          and (\<lambda>s. descendants_of' slot (ctes_of s) = {})
                          and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))"
                      and Q="{s. \<not> capIsDevice (cteCap cte)
                          \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte))
                              (2 ^ (capBlockSize (cteCap cte))) s}"
                 in mapME_x_simpl_sequence_fun_related) apply (rule nth_equalityI) apply (simp add: length_upto_enum_step) apply (simp add: getFreeRef_def shiftr_div_2n_w Kernel_Config.resetChunkBits_def
                                word_size) apply (simp add: length_upto_enum_step upto_enum_step_nth
                               less_Suc_eq_le nth_rev getFreeRef_def
                               Kernel_Config.resetChunkBits_def shiftr_div_2n_w word_size
                               and_not_mask shiftl_t2n) apply clarify apply (rule_tac Q="\<lambda>v. cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = v) slot"
                   and Q'="\<top>\<top>" and V="\<lambda>v. x = (getFreeRef (capPtr (cteCap cte)) v) - 1
                           && ~~ mask resetChunkBits"
                   in ccorres_req_Ex) apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps) apply (clarsimp simp add: shiftL_nat) apply (rename_tac prior_idx) apply (rule ccorres_guard_imp2) apply (rule ccorres_rhs_assoc)+ apply (ctac add: clearMemory_untyped_ccorres[where ut_slot=slot]) apply csymbr apply (rule ccorres_move_c_guard_cte) apply (rule ccorres_split_nothrow_novcg) apply (rule_tac cap'="(cteCap cte)\<lparr> capFreeIndex := prior_idx \<rparr>"
                          in updateFreeIndex_ccorres) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: typ_heap_simps' cap_get_tag_isCap
                                   dest!: ccte_relation_ccap_relation) apply (drule(1) isUntypedCap_ccap_relation_helper)+ apply (drule isUntypedCap_ccap_relation_helper, clarsimp simp: isCap_simps) apply (rule exI, strengthen refl, simp) apply (simp only: t_hrs_update_use_t_hrs mex_def meq_def,
                      simp only: fun_app_def, strengthen exI[mk_strg I], strengthen refl) apply (clarsimp simp: isCap_simps) apply (simp add: getFreeIndex_def) apply (clarsimp simp: in_set_conv_nth
                                          length_upto_enum_step upto_enum_step_nth
                                          less_Suc_eq_le getFreeRef_def) apply (frule(2) reset_untyped_inner_offs_helper, simp+) apply (clarsimp simp: valid_cap_simps' capAligned_def
                                          is_aligned_mask_out_add_eq_sub[OF is_aligned_weaken]) apply (rule less_mask_eq, rule shiftr_less_t2n,
                           erule order_less_le_trans, rule two_power_increasing,
                           simp_all)[1] apply ceqv apply (rule ccorres_add_returnOk) apply (ctac add: preemptionPoint_ccorres) apply (rule ccorres_from_vcg[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def cintr_def) apply wp apply (simp, vcg exspec=preemptionPoint_modifies) apply (wp updateFreeIndex_clear_invs') apply (simp add: guard_is_UNIV_def) apply (wp hoare_vcg_ex_lift doMachineOp_psp_no_overlap) apply clarsimp apply (vcg exspec=cleanCacheRange_RAM_preserves_bytes) apply clarify apply (rule conjI) apply (clarsimp simp: invs_valid_objs' cte_wp_at_ctes_of
                                    invs_urz
                                    getFreeIndex_def isCap_simps
                                    invs_pspace_aligned'
                                    invs_pspace_distinct'
                          simp del: ) apply (frule valid_global_refsD_with_objSize, clarsimp) apply (clarsimp simp: conj_comms in_set_conv_nth
                                    length_upto_enum_step upto_enum_step_nth
                                    less_Suc_eq_le getFreeRef_def) apply (frule(2) reset_untyped_inner_offs_helper, simp+) apply (clarsimp simp: valid_cap_simps' capAligned_def
                                    aligned_offset_non_zero cteCaps_of_def
                                    is_aligned_mask_out_add_eq_sub[OF is_aligned_weaken]
                                    if_split[where P="\<lambda>z. a \<le> z" for a]) apply (strengthen is_aligned_mult_triv2[THEN is_aligned_weaken]
                  aligned_sub_aligned
                  aligned_intvl_offset_subset_ran
                  unat_le_helper Aligned.is_aligned_neg_mask) apply (simp add: order_less_imp_le Kernel_Config.resetChunkBits_def untypedBits_defs) apply (clarsimp simp: in_set_conv_nth isCap_simps
                                   length_upto_enum_step upto_enum_step_nth
                                   less_Suc_eq_le getFreeRef_def
                                   cte_wp_at_ctes_of getFreeIndex_def
                                   hrs_mem_update) apply (frule valid_global_refsD_with_objSize, clarsimp) apply (frule(2) reset_untyped_inner_offs_helper, simp+) apply (frule ctes_of_valid', clarify+) apply (clarsimp simp: valid_cap_simps') apply (strengthen ghost_assertion_size_logic[unfolded o_def, rotated, mk_strg I E]
                               is_aligned_weaken[where y=2 and x=resetChunkBits]
                               is_aligned_weaken[where y=8 and x=resetChunkBits]
                               is_aligned_no_overflow'[where n=8, simplified]
                               power_increasing[where a=2 and n=8, simplified]
                               region_actually_is_bytes_dom_s[mk_strg I E]
                               aligned_intvl_offset_subset[where sz'=8, simplified]
                               is_aligned_mult_triv2[THEN is_aligned_weaken]
                               region_actually_is_bytes_subset_t_hrs[mk_strg I E]
                           | simp)+ apply (clarsimp simp: capAligned_def imp_conjL
                                   aligned_offset_non_zero
                                   is_aligned_add_multI conj_comms
                                   is_aligned_mask_out_add_eq_sub[OF is_aligned_weaken]) apply (strengthen region_actually_is_bytes_subset[mk_strg I E]
                    heap_list_is_zero_mono[OF heap_list_update_eq]
                    order_trans [OF intvl_start_le
                          aligned_intvl_offset_subset[where sz'=resetChunkBits]]
                    byte_regions_unmodified_actually_heap_list[mk_strg I E E]
                | simp add: is_aligned_mult_triv2 hrs_mem_update)+ apply (simp add: unat_sub word_le_nat_alt unat_sub[OF word_and_le2]
                              mask_out_sub_mask word_and_le2
                              unat_of_nat32[OF order_le_less_trans, rotated,
                                OF power_strict_increasing]) apply (case_tac idx') 
              (* must be contradictory *)
               apply clarsimp apply (simp add: is_aligned_def addr_card_def card_word
                               Kernel_Config.resetChunkBits_def) apply clarsimp apply (simp add: is_aligned_def addr_card_def card_word
                               Kernel_Config.resetChunkBits_def) apply (simp add: unat_of_nat32[OF order_le_less_trans, rotated,
                                OF power_strict_increasing]) apply (simp add: word_mod_2p_is_mask[symmetric] Kernel_Config.resetChunkBits_def
                              unat_mod unat_of_nat mod_mod_cancel) apply (strengthen nat_le_Suc_less_imp[OF mod_less_divisor, THEN order_trans]) apply (simp add: is_aligned_def addr_card_def card_word) apply clarsimp apply (rule conseqPre, vcg exspec=cleanCacheRange_RAM_preserves_bytes
              exspec=preemptionPoint_modifies) apply (clarsimp simp: in_set_conv_nth isCap_simps
                                  length_upto_enum_step upto_enum_step_nth
                                  less_Suc_eq_le getFreeRef_def
                                  cte_wp_at_ctes_of getFreeIndex_def
                                  hrs_mem_update) apply (frule(2) reset_untyped_inner_offs_helper, simp+) apply (clarsimp simp: valid_cap_simps') apply (strengthen is_aligned_weaken[where y=2 and x=resetChunkBits]
                              ghost_assertion_size_logic[unfolded o_def, rotated, mk_strg I E]
                              is_aligned_weaken[where y=8 and x=resetChunkBits]
                              is_aligned_no_overflow'[where n=8, simplified]
                              power_increasing[where a=2 and n=8, simplified]
                              region_actually_is_bytes_dom_s[mk_strg I E]
                              aligned_intvl_offset_subset[where sz'=8, simplified]
                              is_aligned_mult_triv2[THEN is_aligned_weaken]
                          | simp)+ apply (clarsimp simp: capAligned_def
                                  aligned_offset_non_zero
                                  is_aligned_add_multI conj_comms
                                  region_actually_is_bytes_def) apply (simp add: Kernel_Config.resetChunkBits_def is_aligned_def) apply (rule hoare_pre) apply (wp updateFreeIndex_cte_wp_at updateFreeIndex_clear_invs'
                      updateFreeIndex_pspace_no_overlap'
                      updateFreeIndex_descendants_of2
                      doMachineOp_psp_no_overlap
                      hoare_vcg_ex_lift
              | (wp (once) preemptionPoint_inv, simp, simp add: pspace_no_overlap'_def)
              | simp)+ apply (simp add: cte_wp_at_ctes_of isCap_simps | clarify)+ apply (clarsimp simp: length_upto_enum_step upto_enum_step_nth
                                 less_Suc_eq_le getFreeRef_def
                                 getFreeIndex_def nth_rev
                                 conj_comms invs_pspace_aligned' invs_pspace_distinct'
                                 invs_valid_pspace') apply (frule(1) reset_untyped_inner_offs_helper[OF _ order_refl], simp+) apply (frule ctes_of_valid', clarify+) apply (clarsimp simp: valid_cap_simps' capAligned_def
                                 is_aligned_mask_out_add_eq[OF is_aligned_weaken]
                                 aligned_bump_down Aligned.is_aligned_neg_mask
                                 is_aligned_mask_out_add_eq_sub[OF is_aligned_weaken]) apply (simp add: field_simps) apply (strengthen Aligned.is_aligned_neg_mask unat_le_helper) apply (simp add: Kernel_Config.resetChunkBits_def[unfolded atomize_eq, THEN arg_cong[where f="\<lambda>x. n \<le> x" for n]]) apply (rule order_less_imp_le, erule order_le_less_trans[rotated],
             rule olen_add_eqv[THEN iffD2]) apply (rule order_trans, rule word_mult_le_mono1, rule word_of_nat_le,
             erule order_trans[rotated], simp, simp add: Kernel_Config.resetChunkBits_def) apply (simp only: unat_power_lower32 shiftr_div_2n_w[symmetric]
                              word_size word_bits_def[symmetric]) apply (rule nat_less_power_trans2) apply (rule order_less_le_trans[OF word_shiftr_lt]) apply (simp add: word_bits_def) apply (simp add: word_bits_def Kernel_Config.resetChunkBits_def) apply (simp add: field_simps) apply ceqv apply (rule ccorres_return_CE, simp+)[1] apply wp apply (simp add: ccHoarePost_def guard_is_UNIV_def) apply simp apply (strengthen invs_valid_objs' invs_urz) apply ((rule_tac d="capIsDevice (cteCap cte)" and idx="capFreeIndex (cteCap cte)" in
                deleteObject_no_overlap
        | rule_tac d="capIsDevice (cteCap cte)" and idx="capFreeIndex (cteCap cte)" in
                deleteObjects_cte_wp_at'
        | wp (once) hoare_vcg_const_imp_lift
                hoare_vcg_conj_lift
        | wp (once) deleteObjects_invs'[where p=slot]
                 deleteObjects_descendants[where p=slot]
        | strengthen exI[mk_strg I])+)[1] apply (simp add: word_sle_def) apply vcg apply simp apply vcg apply (rule conseqPre, vcg, clarsimp) apply (rule conjI) apply clarsimp apply (frule if_unsafe_then_capD', clarsimp+) apply (clarsimp simp: cte_wp_at_ctes_of) apply ((strengthen refl eq_UntypedCap_helper
             eq_UntypedCap_helper[symmetric] | simp)+)? apply (frule ctes_of_valid', clarsimp+) apply (simp add: exI)? apply (clarsimp simp: isCap_simps valid_cap_simps' capAligned_def
                         conj_comms invs_valid_pspace'
                         descendants_range'_def2
                         empty_descendants_range_in'
                         getFreeRef_def upto_intvl_eq) apply (frule valid_global_refsD_with_objSize, clarsimp+) apply (strengthen order_le_less_trans[where z="2 ^ n" for n, mk_strg I E]
     order_trans[rotated, where z="gsMaxObjectSize s" for s, mk_strg I E]) apply (strengthen power_strict_increasing
            | simp)+ apply (clarsimp simp: word_bits_def) apply (subgoal_tac "capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte))
       (capFreeIndex (cteCap cte)) - 1") apply (case_tac "the (ctes_of s slot)", simp) apply (frule(3) ex_cte_not_in_untyped_range, clarsimp+) apply (strengthen is_aligned_no_wrap'[where off="a - b" for a b,
        simplified field_simps, mk_strg I E]) apply (simp add: getFreeRef_def nth_rev length_upto_enum_step
                     upto_enum_step_nth word_of_nat_le
                     is_aligned_mask_out_add_eq_sub[OF is_aligned_weaken]) apply (simp add: neg_mask_is_div' Kernel_Config.resetChunkBits_def word_size) apply (safe, simp_all)[1] apply (simp add: getFreeRef_def) apply (strengthen is_aligned_no_wrap'[where off="a - b" for a b,
       simplified field_simps, mk_strg I E]) apply (simp add: word_of_nat_le) apply (clarsimp simp: cte_wp_at_ctes_of) apply (frule(1) rf_sr_ctes_of_clift, clarsimp) apply (frule(2) rf_sr_cte_relation) apply (clarsimp simp: typ_heap_simps'
                 dest!: ccte_relation_ccap_relation) apply (strengthen typ_region_bytes_actually_is_bytes) apply (simp add: hrs_htd_update hrs_mem_update exI) apply (frule(1) isUntypedCap_ccap_relation_helper) apply (frule ctes_of_valid', clarify+) apply (frule valid_global_refsD_with_objSize, clarsimp) apply (clarsimp simp: valid_cap_simps' isCap_simps capAligned_def
                        from_bool_0 cap_to_H_simps) apply (frule(1) ghost_assertion_size_logic_no_unat) apply (simp add: ghost_assertion_data_get_def gs_clear_region_def) apply (strengthen is_aligned_no_overflow'
                    typ_region_bytes_dom_s
                    aligned_intvl_offset_subset
                    intvl_start_le is_aligned_power2
                    heap_list_is_zero_mono[OF heap_list_update_eq]
                    byte_regions_unmodified_actually_heap_list[OF _ _ refl, mk_strg I E]
                    typ_region_bytes_actually_is_bytes[OF refl]
                    region_actually_is_bytes_subset[OF typ_region_bytes_actually_is_bytes[OF refl]]
    | simp add: unat_of_nat imp_conjL hrs_mem_update hrs_htd_update)+ apply (clarsimp simp: order_trans[OF power_increasing[where a=2]]
                        addr_card_def card_word
                        is_aligned_weaken from_bool_0) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) (UNIV \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr slot\<rbrace>) [] (resetUntypedCap slot) (Call resetUntypedCap_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) (UNIV \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr slot\<rbrace>) [] (resetUntypedCap slot) (Call resetUntypedCap_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) (UNIV \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr slot\<rbrace>) [] (resetUntypedCap slot) (Call resetUntypedCap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>srcSlot. srcSlot = cte_Ptr slot \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1529 srcSlot) (?Q'1529 srcSlot) [SKIP] (doE cap <- liftE (getSlotCap slot);
unlessE (capFreeIndex cap = 0) (doE y <- liftE (deleteObjects (capPtr cap) (capBlockSize cap));
if capIsDevice cap \<or> capBlockSize cap < resetChunkBits then liftE (do y <- unless (capIsDevice cap) (doMachineOp (clearMemory (capPtr cap) (shiftL (Suc 0) (capBlockSize cap))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. doE y <- liftE (doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits)));
y <- liftE (updateFreeIndex slot (getFreeIndex (capPtr cap) addr));
preemptionPoint
odE) (rev [capPtr cap , capPtr cap + 2 ^ resetChunkBits .e. getFreeRef (capPtr cap) (capFreeIndex cap) - 1])
odE)
odE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(\<acute>prev_cap);;
(\<acute>block_size :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(\<acute>prev_cap);;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(\<acute>chunk :== 8;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capFreeIndex_'proc(\<acute>prev_cap);;
(\<acute>offset___unsigned_long :== \<acute>ret__unsigned << 4;;
(lvar_nondet_init status_' status_'_update;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capIsDevice_'proc(\<acute>prev_cap);;
(\<acute>deviceMemory :== \<acute>ret__unsigned;;
(IF \<acute>offset___unsigned_long = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val \<acute>regionBase) (unat \<acute>block_size));;
(IF \<acute>deviceMemory = 0 \<longrightarrow> \<acute>block_size < SCAST(32 signed \<rightarrow> 32) \<acute>chunk THEN
  IF \<acute>deviceMemory = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) \<acute>regionBase,\<acute>block_size)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 1 >> unat \<acute>chunk << unat \<acute>chunk))));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat \<acute>chunk) DO
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) (PTR(unit) (ptr_val \<acute>regionBase + \<acute>offset___unsigned_long)),SCAST(32 signed \<rightarrow> 32) \<acute>chunk);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,UCAST(32 \<rightarrow> 32) (\<acute>offset___unsigned_long >> unat 4));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat \<acute>chunk));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1529 srcSlot s \<and> s' \<in> ?Q'1529 srcSlot proof (prove)
goal (2 subgoals):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1529 (cte_Ptr slot)) (?Q'1529 (cte_Ptr slot)) [SKIP] (do cte <- getCTE slot;
unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(\<acute>prev_cap);;
(\<acute>block_size :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(\<acute>prev_cap);;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(\<acute>chunk :== 8;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capFreeIndex_'proc(\<acute>prev_cap);;
(\<acute>offset___unsigned_long :== \<acute>ret__unsigned << 4;;
(lvar_nondet_init status_' status_'_update;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capIsDevice_'proc(\<acute>prev_cap);;
(\<acute>deviceMemory :== \<acute>ret__unsigned;;
(IF \<acute>offset___unsigned_long = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val \<acute>regionBase) (unat \<acute>block_size));;
(IF \<acute>deviceMemory = 0 \<longrightarrow> \<acute>block_size < SCAST(32 signed \<rightarrow> 32) \<acute>chunk THEN
  IF \<acute>deviceMemory = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) \<acute>regionBase,\<acute>block_size)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 1 >> unat \<acute>chunk << unat \<acute>chunk))));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat \<acute>chunk) DO
  CALL clearMemory_'proc(PTR(32 word) (ptr_val \<acute>regionBase + \<acute>offset___unsigned_long),SCAST(32 signed \<rightarrow> 32) \<acute>chunk);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat \<acute>chunk));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1529 srcSlot s \<and> s' \<in> ?Q'1529 srcSlot proof (prove)
goal (2 subgoals):
 1. \<And>cte. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P1551 (cte_Ptr slot) a cte) (?P'1549 cte) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(\<acute>prev_cap);;
(\<acute>block_size :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(\<acute>prev_cap);;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(\<acute>chunk :== 8;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capFreeIndex_'proc(\<acute>prev_cap);;
(\<acute>offset___unsigned_long :== \<acute>ret__unsigned << 4;;
(lvar_nondet_init status_' status_'_update;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capIsDevice_'proc(\<acute>prev_cap);;
(\<acute>deviceMemory :== \<acute>ret__unsigned;;
(IF \<acute>offset___unsigned_long = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val \<acute>regionBase) (unat \<acute>block_size));;
(IF \<acute>deviceMemory = 0 \<longrightarrow> \<acute>block_size < SCAST(32 signed \<rightarrow> 32) \<acute>chunk THEN
  IF \<acute>deviceMemory = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) \<acute>regionBase,\<acute>block_size)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 1 >> unat \<acute>chunk << unat \<acute>chunk))));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat \<acute>chunk) DO
  CALL clearMemory_'proc(PTR(32 word) (ptr_val \<acute>regionBase + \<acute>offset___unsigned_long),SCAST(32 signed \<rightarrow> 32) \<acute>chunk);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat \<acute>chunk));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ?P1551 srcSlot s cte) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?P'1552 srcSlot cte'}
flex-flex pairs:
?P'1552 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?P'1549 (cte_to_H cte') proof (prove)
goal (2 subgoals):
 1. \<And>cte. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A1558 (cte_Ptr slot) cte) (?C'1555 cte) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (\<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']));;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(\<acute>prev_cap);;
(\<acute>block_size :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(\<acute>prev_cap);;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(\<acute>chunk :== 8;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capFreeIndex_'proc(\<acute>prev_cap);;
(\<acute>offset___unsigned_long :== \<acute>ret__unsigned << 4;;
(lvar_nondet_init status_' status_'_update;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capIsDevice_'proc(\<acute>prev_cap);;
(\<acute>deviceMemory :== \<acute>ret__unsigned;;
(IF \<acute>offset___unsigned_long = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val \<acute>regionBase) (unat \<acute>block_size));;
(IF \<acute>deviceMemory = 0 \<longrightarrow> \<acute>block_size < SCAST(32 signed \<rightarrow> 32) \<acute>chunk THEN
  IF \<acute>deviceMemory = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) \<acute>regionBase,\<acute>block_size)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 1 >> unat \<acute>chunk << unat \<acute>chunk))));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat \<acute>chunk) DO
  CALL clearMemory_'proc(PTR(32 word) (ptr_val \<acute>regionBase + \<acute>offset___unsigned_long),SCAST(32 signed \<rightarrow> 32) \<acute>chunk);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat \<acute>chunk));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1558 srcSlot cte and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A1558 (cte_Ptr slot) cte) (?Q'1560 cte) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(\<acute>prev_cap);;
(\<acute>block_size :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(\<acute>prev_cap);;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(\<acute>chunk :== 8;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capFreeIndex_'proc(\<acute>prev_cap);;
(\<acute>offset___unsigned_long :== \<acute>ret__unsigned << 4;;
(lvar_nondet_init status_' status_'_update;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capIsDevice_'proc(\<acute>prev_cap);;
(\<acute>deviceMemory :== \<acute>ret__unsigned;;
(IF \<acute>offset___unsigned_long = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val \<acute>regionBase) (unat \<acute>block_size));;
(IF \<acute>deviceMemory = 0 \<longrightarrow> \<acute>block_size < SCAST(32 signed \<rightarrow> 32) \<acute>chunk THEN
  IF \<acute>deviceMemory = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) \<acute>regionBase,\<acute>block_size)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 1 >> unat \<acute>chunk << unat \<acute>chunk))));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat \<acute>chunk) DO
  CALL clearMemory_'proc(PTR(32 word) (ptr_val \<acute>regionBase + \<acute>offset___unsigned_long),SCAST(32 signed \<rightarrow> 32) \<acute>chunk);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(\<acute>prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat \<acute>chunk));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) (?Q'1560 cte)
 3. \<And>cte s. ?A1558 (cte_Ptr slot) cte s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1558 srcSlot cte and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte rv'. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A1558 (cte_Ptr slot) cte) (?G'1564 cte rv') [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(rv');;
(\<acute>block_size :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(rv');;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(\<acute>chunk :== 8;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capFreeIndex_'proc(rv');;
(\<acute>offset___unsigned_long :== \<acute>ret__unsigned << 4;;
(lvar_nondet_init status_' status_'_update;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capIsDevice_'proc(rv');;
(\<acute>deviceMemory :== \<acute>ret__unsigned;;
(IF \<acute>offset___unsigned_long = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val \<acute>regionBase) (unat \<acute>block_size));;
(IF \<acute>deviceMemory = 0 \<longrightarrow> \<acute>block_size < SCAST(32 signed \<rightarrow> 32) \<acute>chunk THEN
  IF \<acute>deviceMemory = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) \<acute>regionBase,\<acute>block_size)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(rv',0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 1 >> unat \<acute>chunk << unat \<acute>chunk))));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat \<acute>chunk) DO
  CALL clearMemory_'proc(PTR(32 word) (ptr_val \<acute>regionBase + \<acute>offset___unsigned_long),SCAST(32 signed \<rightarrow> 32) \<acute>chunk);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(rv',\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat \<acute>chunk));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> ?G'1564 cte (prev_cap_' s)}
 3. \<And>cte s. ?A1558 (cte_Ptr slot) cte s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1558 srcSlot cte and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A1558 (cte_Ptr slot) cte) (?G'1564 cte prev_cap) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(prev_cap);;
(\<acute>block_size :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(prev_cap);;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(\<acute>chunk :== 8;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capFreeIndex_'proc(prev_cap);;
(\<acute>offset___unsigned_long :== \<acute>ret__unsigned << 4;;
(lvar_nondet_init status_' status_'_update;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capIsDevice_'proc(prev_cap);;
(\<acute>deviceMemory :== \<acute>ret__unsigned;;
(IF \<acute>offset___unsigned_long = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val \<acute>regionBase) (unat \<acute>block_size));;
(IF \<acute>deviceMemory = 0 \<longrightarrow> \<acute>block_size < SCAST(32 signed \<rightarrow> 32) \<acute>chunk THEN
  IF \<acute>deviceMemory = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) \<acute>regionBase,\<acute>block_size)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 1 >> unat \<acute>chunk << unat \<acute>chunk))));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat \<acute>chunk) DO
  CALL clearMemory_'proc(PTR(32 word) (ptr_val \<acute>regionBase + \<acute>offset___unsigned_long),SCAST(32 signed \<rightarrow> 32) \<acute>chunk);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat \<acute>chunk));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> ?G'1564 cte (prev_cap_' s)}
 3. \<And>cte s. ?A1558 (cte_Ptr slot) cte s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1558 srcSlot cte and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. ccap_relation (cteCap cte) prev_cap \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A1558 (cte_Ptr slot) cte) (?G'2284 cte prev_cap) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(prev_cap);;
(\<acute>block_size :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(prev_cap);;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(\<acute>chunk :== 8;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capFreeIndex_'proc(prev_cap);;
(\<acute>offset___unsigned_long :== \<acute>ret__unsigned << 4;;
(lvar_nondet_init status_' status_'_update;;
(\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capIsDevice_'proc(prev_cap);;
(\<acute>deviceMemory :== \<acute>ret__unsigned;;
(IF \<acute>offset___unsigned_long = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val \<acute>regionBase) (unat \<acute>block_size))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val \<acute>regionBase) (unat \<acute>block_size));;
(IF \<acute>deviceMemory = 0 \<longrightarrow> \<acute>block_size < SCAST(32 signed \<rightarrow> 32) \<acute>chunk THEN
  IF \<acute>deviceMemory = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) \<acute>regionBase,\<acute>block_size)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 1 >> unat \<acute>chunk << unat \<acute>chunk))));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat \<acute>chunk) DO
  CALL clearMemory_'proc(PTR(32 word) (ptr_val \<acute>regionBase + \<acute>offset___unsigned_long),SCAST(32 signed \<rightarrow> 32) \<acute>chunk);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat \<acute>chunk));;
Guard ShiftError \<lbrace>0 \<le>s \<acute>chunk\<rbrace> (Guard ShiftError \<lbrace>\<acute>chunk <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> ?G'2284 cte (prev_cap_' s) \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ?A1558 (cte_Ptr slot) cte s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1558 srcSlot cte and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>ccap_relation (cteCap cte) prev_cap; ret__unsigneda = capBlockSize_CL (cap_untyped_cap_lift prev_cap); ret__unsignedb = capPtr_CL (cap_untyped_cap_lift prev_cap); ret__unsignedc = capFreeIndex_CL (cap_untyped_cap_lift prev_cap); ret__unsigned = capIsDevice_CL (cap_untyped_cap_lift prev_cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A1558 (cte_Ptr slot) cte) (?G'5668 cte prev_cap ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (IF ret__unsignedc << 4 = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val (PTR(unit) ret__unsignedb)) (unat ret__unsigneda)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val (PTR(unit) ret__unsignedb)) (unat ret__unsigneda))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val (PTR(unit) ret__unsignedb)) (unat ret__unsigneda));;
(IF ret__unsigned = 0 \<longrightarrow> ret__unsigneda < SCAST(32 signed \<rightarrow> 32) 8 THEN
  IF ret__unsigned = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) (PTR(unit) ret__unsignedb),ret__unsigneda)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== (ret__unsignedc << 4) - 1 >> unat 8 << unat 8))));;
Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat 8) DO
  CALL clearMemory_'proc(PTR(32 word) (ptr_val (PTR(unit) ret__unsignedb) + \<acute>offset___unsigned_long),SCAST(32 signed \<rightarrow> 32) 8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat 8));;
Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> ?G'5668 cte (prev_cap_' s) v va vb vc}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ?A1558 (cte_Ptr slot) cte s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1558 srcSlot cte and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned. \<lbrakk>ccap_relation (cteCap cte) prev_cap; ret__unsigneda = capBlockSize_CL (cap_untyped_cap_lift prev_cap); ret__unsignedb = capPtr_CL (cap_untyped_cap_lift prev_cap); ret__unsignedc = capFreeIndex_CL (cap_untyped_cap_lift prev_cap); ret__unsigned = capIsDevice_CL (cap_untyped_cap_lift prev_cap); isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6162 (cte_Ptr slot) cte) (?G'5668 cte prev_cap ret__unsigneda ret__unsignedb ret__unsignedc ret__unsigned) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (IF ret__unsignedc << 4 = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val (PTR(unit) ret__unsignedb)) (unat ret__unsigneda)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val (PTR(unit) ret__unsignedb)) (unat ret__unsigneda))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val (PTR(unit) ret__unsignedb)) (unat ret__unsigneda));;
(IF ret__unsigned = 0 \<longrightarrow> ret__unsigneda < SCAST(32 signed \<rightarrow> 32) 8 THEN
  IF ret__unsigned = 0 THEN
  CALL clearMemory_'proc(PTR_COERCE(unit \<rightarrow> 32 word) (PTR(unit) ret__unsignedb),ret__unsigneda)
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== (ret__unsignedc << 4) - 1 >> unat 8 << unat 8))));;
Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> - (2 ^ unat 8) DO
  CALL clearMemory_'proc(PTR(32 word) (ptr_val (PTR(unit) ret__unsignedb) + \<acute>offset___unsigned_long),SCAST(32 signed \<rightarrow> 32) 8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 2 ^ unat 8));;
Guard ShiftError \<lbrace>0 \<le>s 8\<rbrace> (Guard ShiftError \<lbrace>8 <s 0x20\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> ?G'5668 cte (prev_cap_' s) v va vb vc}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. (?G6162 (cte_Ptr slot) cte and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?G6162 srcSlot cte and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6162 (cte_Ptr slot) cte) (?G'5668 cte prev_cap (capBlockSize_CL (cap_untyped_cap_lift prev_cap)) (capPtr_CL (cap_untyped_cap_lift prev_cap)) (capFreeIndex_CL (cap_untyped_cap_lift prev_cap)) (capIsDevice_CL (cap_untyped_cap_lift prev_cap))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (IF capFreeIndex_CL (cap_untyped_cap_lift prev_cap) << 4 = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift prev_cap)) (unat (capBlockSize_CL (cap_untyped_cap_lift prev_cap)))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift prev_cap)) (unat (capBlockSize_CL (cap_untyped_cap_lift prev_cap))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr_CL (cap_untyped_cap_lift prev_cap)) (unat (capBlockSize_CL (cap_untyped_cap_lift prev_cap))));;
(IF capIsDevice_CL (cap_untyped_cap_lift prev_cap) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift prev_cap) < 8 THEN
  IF capIsDevice_CL (cap_untyped_cap_lift prev_cap) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr_CL (cap_untyped_cap_lift prev_cap)),capBlockSize_CL (cap_untyped_cap_lift prev_cap))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== (capFreeIndex_CL (cap_untyped_cap_lift prev_cap) << 4) - 1 >> 8 << 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr_CL (cap_untyped_cap_lift prev_cap) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> ?G'5668 cte (prev_cap_' s) v va vb vc}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. (?G6162 (cte_Ptr slot) cte and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?G6162 srcSlot cte and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift prev_cap = Some (Cap_untyped_cap (cap_untyped_cap_lift prev_cap)) \<and> cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6162 (cte_Ptr slot) cte) (?G'5668 cte prev_cap (capBlockSize_CL (cap_untyped_cap_lift prev_cap)) (capPtr_CL (cap_untyped_cap_lift prev_cap)) (capFreeIndex_CL (cap_untyped_cap_lift prev_cap)) (capIsDevice_CL (cap_untyped_cap_lift prev_cap))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (IF capFreeIndex_CL (cap_untyped_cap_lift prev_cap) << 4 = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift prev_cap)) (unat (capBlockSize_CL (cap_untyped_cap_lift prev_cap)))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift prev_cap)) (unat (capBlockSize_CL (cap_untyped_cap_lift prev_cap))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr_CL (cap_untyped_cap_lift prev_cap)) (unat (capBlockSize_CL (cap_untyped_cap_lift prev_cap))));;
(IF capIsDevice_CL (cap_untyped_cap_lift prev_cap) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift prev_cap) < 8 THEN
  IF capIsDevice_CL (cap_untyped_cap_lift prev_cap) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr_CL (cap_untyped_cap_lift prev_cap)),capBlockSize_CL (cap_untyped_cap_lift prev_cap))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== (capFreeIndex_CL (cap_untyped_cap_lift prev_cap) << 4) - 1 >> 8 << 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr_CL (cap_untyped_cap_lift prev_cap) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> ?G'5668 cte (prev_cap_' s) v va vb vc}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. (?G6162 (cte_Ptr slot) cte and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?G6162 srcSlot cte and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6162 (cte_Ptr slot) cte) (?G'5668 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (IF word_of_nat (capFreeIndex (cteCap cte)) = 0 THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> ?G'5668 cte (prev_cap_' s) v va vb vc}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. (?G6162 (cte_Ptr slot) cte and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?G6162 srcSlot cte and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (5 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) = 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6314 (cte_Ptr slot) cte) (?S6316 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (SKIP;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> ?S6316 cte (prev_cap_' s) v va vb vc) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 4. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> ?Q6314 (cte_Ptr slot) cte a) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> ?Q6314 srcSlot cte a) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (5 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) = 0; capFreeIndex (cteCap cte) = 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6314 (cte_Ptr slot) cte) (?S6316 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (SKIP;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> ?S6316 cte (prev_cap_' s) v va vb vc) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 4. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> ?Q6314 (cte_Ptr slot) cte a) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> ?Q6314 srcSlot cte a) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (5 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; capFreeIndex (cteCap cte) = 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6314 (cte_Ptr slot) cte) (?S6316 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) 0 (from_bool (capIsDevice (cteCap cte)))) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (SKIP;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> ?S6316 cte (prev_cap_' s) v va vb vc) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 4. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> ?Q6314 (cte_Ptr slot) cte a) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> ?Q6314 srcSlot cte a) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; capFreeIndex (cteCap cte) = 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6314 (cte_Ptr slot) cte) (?P'6346 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) 0 (from_bool (capIsDevice (cteCap cte)))) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; capFreeIndex (cteCap cte) = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6345 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) 0 (from_bool (capIsDevice (cteCap cte)))) return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},UNIV
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (SKIP;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> ?P'6346 cte (prev_cap_' s) v va vb vc \<inter> ?R'6345 cte (prev_cap_' s) v va vb vc) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> ?Q6314 (cte_Ptr slot) cte a) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> ?Q6314 srcSlot cte a) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (5 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; capFreeIndex (cteCap cte) = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6345 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) 0 (from_bool (capIsDevice (cteCap cte)))) return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},UNIV
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (SKIP;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> ?R'6345 cte (prev_cap_' s) v va vb vc) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 4. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (SKIP;;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte))))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (unat (word_of_nat (capBlockSize (cteCap cte)))));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte)));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (unlessE (capFreeIndex (cteCap cte) = 0) (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte)));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte)));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte)));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte)));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6313 (cte_Ptr slot) cte) (?T6315 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (do y <- deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte));
if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte)));;
(IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?T6315 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 (cte_Ptr slot) cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> ?R6313 srcSlot cte a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (8 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (?r'6369 cte prev_cap) (?xf'6369 cte prev_cap) (?P6376 (cte_Ptr slot) cte) (?P'6371 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) [SKIP] (deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))))
 2. \<And>cte prev_cap rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'6369 cte prev_cap) rv' t t' (IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6369 cte prev_cap rv')
 3. \<And>cte prev_cap rv rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); ?r'6369 cte prev_cap rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6369 cte prev_cap rv) (?Q'6369 cte prev_cap rv rv') [SKIP] (if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (?d'6369 cte prev_cap rv')
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>?Q6369 cte prev_cap\<rbrace>
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. ?r'6369 cte prev_cap rv (?xf'6369 cte prev_cap s) \<longrightarrow> s \<in> ?Q'6369 cte prev_cap rv (?xf'6369 cte prev_cap s)}
 6. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> ?P'6371 cte (prev_cap_' s) v va vb vc \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 7. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (?P6376 (cte_Ptr slot) cte and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (?P6376 srcSlot cte and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (7 subgoals):
 1. \<And>cte prev_cap rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6369 cte prev_cap rv')
 2. \<And>cte prev_cap rv rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6369 cte prev_cap rv) (?Q'6369 cte prev_cap rv rv') [SKIP] (if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (?d'6369 cte prev_cap rv')
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>?Q6369 cte prev_cap\<rbrace>
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6369 cte prev_cap rv (xfdc s)}
 5. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 6. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6386 (cte_Ptr slot) \<equiv>\<^sup>? ?d6388 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6369 cte prev_cap rv) (?Q'6369 cte prev_cap rv rv') [SKIP] (if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>?Q6369 cte prev_cap\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6369 cte prev_cap rv (xfdc s)}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6369 cte prev_cap ()) (?Q'6369 cte prev_cap () rv') [SKIP] (if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>?Q6369 cte prev_cap\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6369 cte prev_cap rv (xfdc s)}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6369 cte prev_cap ()) (?Q'6369 cte prev_cap () rv') [SKIP] (if capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits then liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od) else mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (IF from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8 THEN
  IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>?Q6369 cte prev_cap\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6369 cte prev_cap rv (xfdc s)}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (8 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) = (s' \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>)
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt6420 cte prev_cap ()) (?Rt6415 cte prev_cap () rv') [SKIP] (liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od)) (IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ?Pt6420 cte prev_cap a s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Rt6415 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 6. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 7. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (8 subgoals):
 1. \<And>cte prev_cap s s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < 8) = (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8)
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt6420 cte prev_cap ()) (?Rt6415 cte prev_cap () rv') [SKIP] (liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od)) (IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ?Pt6420 cte prev_cap a s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Rt6415 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 6. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 7. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (8 subgoals):
 1. \<And>cte prev_cap s s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < 8) = (\<not> capIsDevice (cteCap cte) \<longrightarrow> capBlockSize (cteCap cte) < 8)
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt6420 cte prev_cap ()) (?Rt6415 cte prev_cap () rv') [SKIP] (liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od)) (IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ?Pt6420 cte prev_cap a s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Rt6415 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 6. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 7. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (7 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt6420 cte prev_cap ()) (?Rt6415 cte prev_cap () rv') [SKIP] (liftE (do y <- unless (capIsDevice (cteCap cte)) (doMachineOp (clearMemory (capPtr (cteCap cte)) (shiftL (Suc 0) (capBlockSize (cteCap cte)))));
updateFreeIndex slot 0
od)) (IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ?Pt6420 cte prev_cap a s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Rt6415 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 5. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 6. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (7 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt6420 cte prev_cap ()) (?Rt6415 cte prev_cap () rv') [SKIP] (do x <- if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return ();
r <- updateFreeIndex slot 0;
return (Inr ())
od) (IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ?Pt6420 cte prev_cap a s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Rt6415 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 5. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 6. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (7 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt6420 cte prev_cap ()) (?Rt6415 cte prev_cap () rv') [SKIP] (do x <- if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return ();
r <- updateFreeIndex slot 0;
return (Inr ())
od) (IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ?Pt6420 cte prev_cap a s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Rt6415 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 5. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 6. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P6455 cte prev_cap ()) (?P'6450 cte prev_cap () rv') [SKIP] (if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return ()) (IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI)
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'6448 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6448 cte prev_cap rv' rv) (?Q'6448 cte prev_cap rv' rv rv'a) [SKIP] (do r <- updateFreeIndex slot 0;
return (Inr ())
od) (?d'6448 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>?Q6448 cte prev_cap rv'\<rbrace>
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6448 cte prev_cap rv' rv (xfdc s)}
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (?P6455 cte prev_cap a and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?P'6450 cte prev_cap rv (xfdc s) \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (\<not> capIsDevice (cteCap cte)) = (s' \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace>)
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt6471 cte prev_cap ()) (?Rt6468 cte prev_cap () rv') [SKIP] (doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)))) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte))))
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf6469 cte prev_cap ()) (?Rf6467 cte prev_cap () rv') [SKIP] (return ()) SKIP
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'6448 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6448 cte prev_cap rv' rv) (?Q'6448 cte prev_cap rv' rv rv'a) [SKIP] (do r <- updateFreeIndex slot 0;
return (Inr ())
od) (?d'6448 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>?Q6448 cte prev_cap rv'\<rbrace>
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6448 cte prev_cap rv' rv (xfdc s)}
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ?Pt6471 cte prev_cap a s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> ?Pf6469 cte prev_cap a s) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> sa \<in> ?Rt6468 cte prev_cap rv (xfdc s)) \<and> (sa \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf6467 cte prev_cap rv (xfdc s))} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt6471 cte prev_cap ()) (?Rt6468 cte prev_cap () rv') [SKIP] (doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)))) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte))))
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf6469 cte prev_cap ()) (?Rf6467 cte prev_cap () rv') [SKIP] (return ()) SKIP
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'6448 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6448 cte prev_cap rv' rv) (?Q'6448 cte prev_cap rv' rv rv'a) [SKIP] (do r <- updateFreeIndex slot 0;
return (Inr ())
od) (?d'6448 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>?Q6448 cte prev_cap rv'\<rbrace>
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6448 cte prev_cap rv' rv (xfdc s)}
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ?Pt6471 cte prev_cap a s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> ?Pf6469 cte prev_cap a s) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> sa \<in> ?Rt6468 cte prev_cap rv (xfdc s)) \<and> (sa \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf6467 cte prev_cap rv (xfdc s))} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf6469 cte prev_cap ()) (?Rf6467 cte prev_cap () rv') [SKIP] (return ()) SKIP
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'6448 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6448 cte prev_cap rv' rv) (?Q'6448 cte prev_cap rv' rv rv'a) [SKIP] (do r <- updateFreeIndex slot 0;
return (Inr ())
od) (?d'6448 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>?Q6448 cte prev_cap rv'\<rbrace>
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6448 cte prev_cap rv' rv (xfdc s)}
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> ?Pf6469 cte prev_cap a s) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> sa \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (sa \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf6467 cte prev_cap rv (xfdc s))} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'6448 cte prev_cap rv' rv'a)
 2. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6448 cte prev_cap rv' rv) (?Q'6448 cte prev_cap rv' rv rv'a) [SKIP] (do r <- updateFreeIndex slot 0;
return (Inr ())
od) (?d'6448 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>?Q6448 cte prev_cap rv'\<rbrace>
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6448 cte prev_cap rv' rv (xfdc s)}
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (9 subgoals):
 1. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6448 cte prev_cap rv' rv) (?Q'6448 cte prev_cap rv' rv rv'a) [SKIP] (do r <- updateFreeIndex slot 0;
return (Inr ())
od) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>?Q6448 cte prev_cap rv'\<rbrace>
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6448 cte prev_cap rv' rv (xfdc s)}
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 7. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 8. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (9 subgoals):
 1. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6448 cte prev_cap rv' rv) (?Q'6448 cte prev_cap rv' rv rv'a) [SKIP] (do r <- updateFreeIndex slot 0;
return (Inr ())
od) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>?Q6448 cte prev_cap rv'\<rbrace>
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6448 cte prev_cap rv' rv (xfdc s)}
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 7. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 8. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (?r'6510 cte prev_cap rv' rv rv'a) (?xf'6510 cte prev_cap rv' rv rv'a) (?P6516 cte prev_cap rv' rv) (?Q'6448 cte prev_cap rv' rv rv'a) [] (updateFreeIndex slot 0) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))))
 2. \<And>cte prev_cap rv' rv rv'a rv'b t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'6510 cte prev_cap rv' rv rv'a) rv'b t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 3. \<And>cte prev_cap rv' rv rv'a rva rv'b. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a; ?r'6510 cte prev_cap rv' rv rv'a rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6510 cte prev_cap rv' rv rv'a rva) (?Q'6510 cte prev_cap rv' rv rv'a rva rv'b) [SKIP] (return (Inr ())) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' rv\<rbrace> updateFreeIndex slot 0 \<lbrace>?Q6510 cte prev_cap rv' rv rv'a\<rbrace>
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'6510 cte prev_cap rv' rv rv'a) (?xf'6510 cte prev_cap rv' rv rv'a) (?Q'6510 cte prev_cap rv' rv rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. ?P6516 cte prev_cap rv' a and ?R6514 cte prev_cap rv' a\<rbrace>
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6448 cte prev_cap rv' rv (xfdc s)}
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile> ({s} \<inter> {s. \<exists>ctea cte'. cslift s (cte_Ptr slot) = Some cte' \<and> cteCap ctea = cteCap cte \<and> ccte_relation ctea cte'}) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {t. \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cte_Ptr slot))))\<lparr>capFreeIndex_CL := word_of_nat 0 >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cte_Ptr slot))))) (t_hrs_' (globals s)) \<and> t may_only_modify_globals s in [t_hrs]}
 2. \<And>cte prev_cap rv' rv rv'a rv'b t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 3. \<And>cte prev_cap rv' rv rv'a rva rv'b. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6510 cte prev_cap rv' rv rv'a rva) (?Q'6510 cte prev_cap rv' rv rv'a rva rv'b) [SKIP] (return (Inr ())) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' rv\<rbrace> updateFreeIndex slot 0 \<lbrace>?Q6510 cte prev_cap rv' rv rv'a\<rbrace>
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'6510 cte prev_cap rv' rv rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and ?R6514 cte prev_cap rv' a\<rbrace>
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap rv' rv rv'a s. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> {s} \<inter> {s. \<exists>ctea cte'. cslift s (cte_Ptr slot) = Some cte' \<and> cteCap ctea = cteCap cte \<and> ccte_relation ctea cte'} \<subseteq> {sa. cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := 0 && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> sa \<Turnstile>\<^sub>c cte_Ptr slot \<and> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cte_Ptr slot))))\<lparr>capFreeIndex_CL := word_of_nat 0 >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals sa)) = hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cte_Ptr slot))))) (t_hrs_' (globals s)) \<and> globals sa may_only_modify_globals s in [t_hrs]))}
 2. \<And>cte prev_cap rv' rv rv'a rv'b t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 3. \<And>cte prev_cap rv' rv rv'a rva rv'b. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6510 cte prev_cap rv' rv rv'a rva) (?Q'6510 cte prev_cap rv' rv rv'a rva rv'b) [SKIP] (return (Inr ())) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' rv\<rbrace> updateFreeIndex slot 0 \<lbrace>?Q6510 cte prev_cap rv' rv rv'a\<rbrace>
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'6510 cte prev_cap rv' rv rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and ?R6514 cte prev_cap rv' a\<rbrace>
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s ctea cte' t. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); cslift s (cte_Ptr slot) = Some cte'; cteCap ctea = cteCap cte; ccap_relation (cteCap cte) (cte_C.cap_C cte'); cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 0\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' t) cte')) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs]
 2. \<And>cte prev_cap rv' rv rv'a rv'b t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 3. \<And>cte prev_cap rv' rv rv'a rva rv'b. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6510 cte prev_cap rv' rv rv'a rva) (?Q'6510 cte prev_cap rv' rv rv'a rva rv'b) [SKIP] (return (Inr ())) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' rv\<rbrace> updateFreeIndex slot 0 \<lbrace>?Q6510 cte prev_cap rv' rv rv'a\<rbrace>
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'6510 cte prev_cap rv' rv rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and ?R6514 cte prev_cap rv' a\<rbrace>
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s ctea cte' t. \<lbrakk>isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); cslift s (cte_Ptr slot) = Some cte'; cteCap ctea = cteCap cte; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift prev_cap = Some (Cap_untyped_cap (cap_untyped_cap_lift prev_cap)) \<and> cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<and> cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>\<rbrakk> \<Longrightarrow> \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 0\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' t) cte')) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs]
 2. \<And>cte prev_cap rv' rv rv'a rv'b t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 3. \<And>cte prev_cap rv' rv rv'a rva rv'b. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6510 cte prev_cap rv' rv rv'a rva) (?Q'6510 cte prev_cap rv' rv rv'a rva rv'b) [SKIP] (return (Inr ())) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' rv\<rbrace> updateFreeIndex slot 0 \<lbrace>?Q6510 cte prev_cap rv' rv rv'a\<rbrace>
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'6510 cte prev_cap rv' rv rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and ?R6514 cte prev_cap rv' a\<rbrace>
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s ctea cte' t. \<lbrakk>isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); cslift s (cte_Ptr slot) = Some cte'; cteCap ctea = cteCap cte; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift prev_cap = Some (Cap_untyped_cap (cap_untyped_cap_lift prev_cap)) \<and> cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<and> cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>\<rbrakk> \<Longrightarrow> globals s may_only_modify_globals s in [t_hrs]
 2. \<And>cte prev_cap rv' rv rv'a rv'b t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 3. \<And>cte prev_cap rv' rv rv'a rva rv'b. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6510 cte prev_cap rv' rv rv'a rva) (?Q'6510 cte prev_cap rv' rv rv'a rva rv'b) [SKIP] (return (Inr ())) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' rv\<rbrace> updateFreeIndex slot 0 \<lbrace>?Q6510 cte prev_cap rv' rv rv'a\<rbrace>
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'6510 cte prev_cap rv' rv rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and ?R6514 cte prev_cap rv' a\<rbrace>
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s ctea cte' t. \<lbrakk>isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); cslift s (cte_Ptr slot) = Some cte'; cteCap ctea = cteCap cte; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift prev_cap = Some (Cap_untyped_cap (cap_untyped_cap_lift prev_cap)) \<and> cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<and> cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>\<rbrakk> \<Longrightarrow> \<exists>t_hrs_'a. (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s))) $ globals s) = (t_hrs_'_update (\<lambda>_. t_hrs_'a) $ globals s)
 2. \<And>cte prev_cap rv' rv rv'a rv'b t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 3. \<And>cte prev_cap rv' rv rv'a rva rv'b. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6510 cte prev_cap rv' rv rv'a rva) (?Q'6510 cte prev_cap rv' rv rv'a rva rv'b) [SKIP] (return (Inr ())) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' rv\<rbrace> updateFreeIndex slot 0 \<lbrace>?Q6510 cte prev_cap rv' rv rv'a\<rbrace>
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'6510 cte prev_cap rv' rv rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and ?R6514 cte prev_cap rv' a\<rbrace>
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap rv' rv rv'a rv'b t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 2. \<And>cte prev_cap rv' rv rv'a rva rv'b. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6510 cte prev_cap rv' rv rv'a rva) (?Q'6510 cte prev_cap rv' rv rv'a rva rv'b) [SKIP] (return (Inr ())) (?d'6510 cte prev_cap rv' rv rv'a rv'b)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' rv\<rbrace> updateFreeIndex slot 0 \<lbrace>?Q6510 cte prev_cap rv' rv rv'a\<rbrace>
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'6510 cte prev_cap rv' rv rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and ?R6514 cte prev_cap rv' a\<rbrace>
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap rv' rv rv'a rva rv'b. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6510 cte prev_cap rv' rv rv'a rva) (?Q'6510 cte prev_cap rv' rv rv'a rva rv'b) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' rv\<rbrace> updateFreeIndex slot 0 \<lbrace>?Q6510 cte prev_cap rv' rv rv'a\<rbrace>
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'6510 cte prev_cap rv' rv rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and ?R6514 cte prev_cap rv' a\<rbrace>
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6514 cte prev_cap rv' ()\<rbrace> updateFreeIndex slot 0 \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>)
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and ?R6514 cte prev_cap rv' a\<rbrace>
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (9 subgoals):
 1. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>)
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and (\<lambda>a. True)\<rbrace>
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 7. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 8. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (8 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6453 cte prev_cap ()\<rbrace> if \<not> capIsDevice (cteCap cte) then doMachineOp (clearMemory (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte))) else return () \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) and (\<lambda>a. True)\<rbrace>
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and ?R6453 cte prev_cap a) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 6. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 7. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (7 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte) + word_of_nat 0) (capFreeIndex (cteCap cte) - 0) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte) - 0) (capPtr (cteCap cte) + word_of_nat 0) = replicate (capFreeIndex (cteCap cte) - 0) 0}}
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 5. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 6. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (7 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6448 cte prev_cap rv'\<^esub> (?R'6449 cte prev_cap () rv') IF from_bool (capIsDevice (cteCap cte)) = 0 THEN
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte)),word_of_nat (capBlockSize (cteCap cte)))
FI {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0}
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'6449 cte prev_cap rv (xfdc s) \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 5. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 6. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf6418 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ?Pf6418 cte prev_cap a s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6778 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G6778 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6778 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (WHILE \<acute>offset___unsigned_long \<noteq> 0xFFFFFF00 DO
  CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)
OD));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G6778 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6778 cte prev_cap ()) (?Rf6414 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8))));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (While \<lbrace>\<acute>offset___unsigned_long \<noteq> 0xFFFFFF00\<rbrace> (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP))));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G6778 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?Rf6414 cte prev_cap rv (xfdc s) \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6778 cte prev_cap ()) (?C'6801 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (\<acute>offset___unsigned_long :== word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8;;
(Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (While \<lbrace>\<acute>offset___unsigned_long \<noteq> 0xFFFFFF00\<rbrace> (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP))));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G6778 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> ?C'6801 cte prev_cap rv (xfdc s) \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6778 cte prev_cap ()) (?G'6811 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (if \<exists>n offs. (\<forall>s v. offset___unsigned_long_' (simpl_final_basic (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + v),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,v >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== v - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)) s) - v = offs) \<and> \<not> (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat n * offs \<noteq> 0xFFFFFF00 then simpl_sequence (\<lambda>a. CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + a),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,a >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== a - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)) (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * (THE offs. \<forall>s v. offset___unsigned_long_' (simpl_final_basic (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + v),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,v >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== v - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)) s) - v = offs)) [0..<LEAST n. \<not> (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat n * (THE offs. \<forall>s v. offset___unsigned_long_' (simpl_final_basic (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + v),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,v >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== v - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP)) s) - v = offs) \<noteq> 0xFFFFFF00]) else While \<lbrace>\<acute>offset___unsigned_long \<noteq> 0xFFFFFF00\<rbrace> (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + \<acute>offset___unsigned_long),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,\<acute>offset___unsigned_long >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> (\<acute>offset___unsigned_long :== \<acute>offset___unsigned_long - 0x100));;
Guard ShiftError \<lbrace>True\<rbrace> (Guard ShiftError \<lbrace>True\<rbrace> SKIP))));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G6778 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {sa. sa\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> ?G'6811 cte prev_cap rv (xfdc s)} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6778 cte prev_cap ()) (?G'6811 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (Guard ShiftError UNIV (Guard ShiftError UNIV (simpl_sequence (\<lambda>a. CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + a),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,a >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== a - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))])));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G6778 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {sa. sa\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> ?G'6811 cte prev_cap rv (xfdc s)} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6778 cte prev_cap ()) (?C'7113 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (simpl_sequence (\<lambda>a. CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + a),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,a >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== a - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))]);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G6778 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {sa. sa\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> ?C'7113 cte prev_cap rv (xfdc s) \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6778 cte prev_cap ()) (?C'7113 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) >>=E returnOk) (simpl_sequence (\<lambda>a. CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + a),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,a >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== a - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))]);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G6778 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {sa. sa\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> ?C'7113 cte prev_cap rv (xfdc s) \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'7119 cte prev_cap rv')) (?xf'7119 cte prev_cap rv') (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7125 cte prev_cap ()) (?P'7120 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (simpl_sequence (\<lambda>a. CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + a),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,a >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== a - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))]))
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'7119 cte prev_cap rv') rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); ?r'7119 cte prev_cap rv' rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (?r'7119 cte prev_cap rv')) (?xf'7119 cte prev_cap rv') (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?P7125 cte prev_cap a and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {sa. sa\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> ?P'7120 cte prev_cap rv (xfdc s) \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'7119 cte prev_cap rv')) (?xf'7119 cte prev_cap rv') (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?G7134 cte prev_cap ()) (?P'7120 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (simpl_sequence (\<lambda>a. CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + a),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,a >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== a - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))]))
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'7119 cte prev_cap rv') rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); ?r'7119 cte prev_cap rv' rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (?r'7119 cte prev_cap rv')) (?xf'7119 cte prev_cap rv') (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G7134 cte prev_cap a and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {sa. sa\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> ?P'7120 cte prev_cap rv (xfdc s) \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'7119 cte prev_cap rv')) (?xf'7119 cte prev_cap rv') (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?G7138 cte prev_cap ()) (?P'7120 cte prev_cap () rv') [SKIP] (mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])) (simpl_sequence (\<lambda>a. CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + a),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,a >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== a - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))]))
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'7119 cte prev_cap rv') rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); ?r'7119 cte prev_cap rv' rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (?r'7119 cte prev_cap rv')) (?xf'7119 cte prev_cap rv') (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> (?G7138 cte prev_cap a and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {sa. sa\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> ?P'7120 cte prev_cap rv (xfdc s) \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)\<rbrakk> \<Longrightarrow> map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))] = map (\<lambda>ptr. ptr - capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])
 2. \<And>cte prev_cap rv' n x. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); x \<in> set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> x = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} [SKIP] (do y <- doMachineOp (clearMemory x (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) x);
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (14 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))]) = length (map (\<lambda>ptr. ptr - capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]))
 2. \<And>cte prev_cap rv' i. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); i < length (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))])\<rbrakk> \<Longrightarrow> map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))] ! i = map (\<lambda>ptr. ptr - capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) ! i
 3. \<And>cte prev_cap rv' n x. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); x \<in> set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> x = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} [SKIP] (do y <- doMachineOp (clearMemory x (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) x);
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 4. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 5. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 6. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 9. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (14 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; Ex (valid_cap' (cteCap cte)) \<and> \<not> capIsDevice (cteCap cte)\<rbrakk> \<Longrightarrow> word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8 = (getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 - capPtr (cteCap cte)) div 2 ^ resetChunkBits
 2. \<And>cte prev_cap rv' i. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); i < length (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))])\<rbrakk> \<Longrightarrow> map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))] ! i = map (\<lambda>ptr. ptr - capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) ! i
 3. \<And>cte prev_cap rv' n x. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); x \<in> set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> x = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} [SKIP] (do y <- doMachineOp (clearMemory x (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) x);
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 4. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 5. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 6. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 9. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap rv' i. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); i < length (map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))])\<rbrakk> \<Longrightarrow> map (\<lambda>x. (word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8) + word_of_nat x * 0xFFFFFF00) [0..<Suc (unat (word_of_nat (capFreeIndex (cteCap cte)) - 1 >> 8))] ! i = map (\<lambda>ptr. ptr - capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) ! i
 2. \<And>cte prev_cap rv' n x. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); x \<in> set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> x = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} [SKIP] (do y <- doMachineOp (clearMemory x (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) x);
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap rv' n x. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); x \<in> set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> x = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} [SKIP] (do y <- doMachineOp (clearMemory x (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) x);
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap rv' n x s. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; x \<in> set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]); \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> x = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} [SKIP] (do y <- doMachineOp (clearMemory x (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) x);
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap rv' n x s sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; x \<in> set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]); \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> x = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) sa; s' \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}\<rbrakk> \<Longrightarrow> \<exists>v. cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = v) slot sa \<and> True \<and> x = getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits
 2. \<And>cte prev_cap rv' n x s v. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; x \<in> set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]); \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; x = getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> x = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = v) slot) ({s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>) [SKIP] (do y <- doMachineOp (clearMemory x (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) x);
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap rv' n x s v. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; x \<in> set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]); \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; x = getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> x = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = v) slot) ({s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>) [SKIP] (do y <- doMachineOp (clearMemory x (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) x);
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s v. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = v) slot) ({s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>) [SKIP] (do y <- doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits));
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,(getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) v - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) ({s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>) [SKIP] (do y <- doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits));
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,(getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7167 cte prev_cap s prior_idx) (?Q'7167 cte prev_cap s prior_idx) [SKIP] (do y <- doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits));
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,(getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ?Q7167 cte prev_cap s prior_idx sa \<and> s' \<in> ?Q'7167 cte prev_cap s prior_idx
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7167 cte prev_cap s prior_idx) (?Q'7167 cte prev_cap s prior_idx) [SKIP] (do y <- doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits));
preemptionPoint
od) (CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8);;
(\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,(getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))))))
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ?Q7167 cte prev_cap s prior_idx sa \<and> s' \<in> ?Q'7167 cte prev_cap s prior_idx
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (15 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7182 cte prev_cap s prior_idx rv) (?Q'7182 cte prev_cap s prior_idx rv xfdca) [SKIP] (do y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits));
preemptionPoint
od) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,(getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))))))
 2. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>?Q7182 cte prev_cap s prior_idx\<rbrace>
 3. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> ?Q'7182 cte prev_cap s prior_idx rv (xfdc sa)}
 4. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 5. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 6. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 7. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 8. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 9. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 10. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
A total of 15 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (15 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7182 cte prev_cap s prior_idx ()) (?G'7233 cte prev_cap s prior_idx () xfdca ret__struct_cap_C) [SKIP] (do y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits));
preemptionPoint
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) ret__struct_cap_C)));;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))))
 2. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>?Q7182 cte prev_cap s prior_idx\<rbrace>
 3. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) sb)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) sb)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> sb\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {sb. sb \<in> ?G'7233 cte prev_cap s prior_idx rv (xfdc sa) v}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 4. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 5. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 6. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 7. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 8. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 9. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 10. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
A total of 15 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (15 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?A7432 cte prev_cap s prior_idx ()) (?C'7429 cte prev_cap s prior_idx () xfdca ret__struct_cap_C) [SKIP] (do y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits));
preemptionPoint
od) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) ret__struct_cap_C));;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))))
 2. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. ?A7432 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 3. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) sb)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) sb)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> sb\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {sb. sb \<in> ?C'7429 cte prev_cap s prior_idx rv (xfdc sa) v \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 4. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 5. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 6. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 7. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 8. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 9. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 10. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
A total of 15 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ccorres (?r'7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C) (?xf'7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C) (?P7441 cte prev_cap s prior_idx ()) (?C'7429 cte prev_cap s prior_idx () xfdc ret__struct_cap_C) [] (updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) ret__struct_cap_C)))
 2. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C) rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; ?r'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C) (?xf'7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C) (?Q'7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. ?P7441 cte prev_cap s prior_idx a and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) sb)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) sb)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> sb\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {sb. sb \<in> ?C'7429 cte prev_cap s prior_idx rv (xfdc sa) v \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile> ({s} \<inter> {s. \<exists>ctea cte'. cslift s (cte_Ptr slot) = Some cte' \<and> cteCap ctea = capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) \<and> ccte_relation ctea cte'}) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) ret__struct_cap_C)) {t. \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cte_Ptr slot))))\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cte_Ptr slot))))) (t_hrs_' (globals s)) \<and> t may_only_modify_globals s in [t_hrs]}
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C sa. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> {sa} \<inter> {s. \<exists>ctea cte'. cslift s (cte_Ptr slot) = Some cte' \<and> cteCap ctea = capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) \<and> ccte_relation ctea cte'} \<subseteq> {s. \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift sa (cte_Ptr slot))))\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) ret__struct_cap_C) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift sa (cte_Ptr slot))))) (t_hrs_' (globals sa)) \<and> globals s may_only_modify_globals sa in [t_hrs]}
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte); ccap_relation (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C) cte')) (t_hrs_' (globals sa)) = hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals sa)) \<and> globals sa may_only_modify_globals sa in [t_hrs]
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte'. \<lbrakk>isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte); ccap_relation (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) (cte_C.cap_C cte'); cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift prev_cap = Some (Cap_untyped_cap (cap_untyped_cap_lift prev_cap)) \<and> cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>\<rbrakk> \<Longrightarrow> \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C) cte')) (t_hrs_' (globals sa)) = hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals sa)) \<and> globals sa may_only_modify_globals sa in [t_hrs]
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte'. \<lbrakk>isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte); cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift prev_cap = Some (Cap_untyped_cap (cap_untyped_cap_lift prev_cap)) \<and> cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<and> cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) >> 4, capIsDevice_CL = from_bool (capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))), capBlockSize_CL = word_of_nat (capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))), capPtr_CL = capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))\<rparr>\<rbrakk> \<Longrightarrow> \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C) cte')) (t_hrs_' (globals sa)) = hrs_mem_update (heap_update (cte_Ptr slot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals sa)) \<and> globals sa may_only_modify_globals sa in [t_hrs]
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte'. \<lbrakk>isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte); cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift prev_cap = Some (Cap_untyped_cap (cap_untyped_cap_lift prev_cap)) \<and> cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<and> cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) >> 4, capIsDevice_CL = from_bool (capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))), capBlockSize_CL = word_of_nat (capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))), capPtr_CL = capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))\<rparr>\<rbrakk> \<Longrightarrow> ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26 = word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) >> 4 \<and> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<and> word_of_nat (capBlockSize (cteCap cte)) = word_of_nat (capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) \<and> capPtr (cteCap cte) = capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<and> globals sa may_only_modify_globals sa in [t_hrs]
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte'. \<lbrakk>isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte); cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift prev_cap = Some (Cap_untyped_cap (cap_untyped_cap_lift prev_cap)) \<and> cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<and> cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) >> 4, capIsDevice_CL = from_bool (capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))), capBlockSize_CL = word_of_nat (capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))), capPtr_CL = capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))\<rparr>\<rbrakk> \<Longrightarrow> ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26 = word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) >> 4 \<and> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<and> word_of_nat (capBlockSize (cteCap cte)) = word_of_nat (capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) \<and> capPtr (cteCap cte) = capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<and> True
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte' d v0 v1 f. \<lbrakk>f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> getFreeRef v0 f - 1; getFreeRef v0 prior_idx - 1 && ~~ mask resetChunkBits \<in> set [v0 , v0 + 2 ^ resetChunkBits .e. getFreeRef v0 f - 1]; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = ((getFreeRef v0 prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capability.UntypedCap False v0 v1 prior_idx; cteCap cte = capability.UntypedCap False v0 v1 f; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>\<rbrakk> \<Longrightarrow> ((getFreeRef v0 prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26 = word_of_nat (getFreeIndex v0 (getFreeRef v0 prior_idx - 1 && ~~ mask resetChunkBits)) >> 4
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte' d v0 v1 f. \<lbrakk>f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> getFreeRef v0 f - 1; getFreeRef v0 prior_idx - 1 && ~~ mask resetChunkBits \<in> set [v0 , v0 + 2 ^ resetChunkBits .e. getFreeRef v0 f - 1]; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = ((getFreeRef v0 prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capability.UntypedCap False v0 v1 prior_idx; cteCap cte = capability.UntypedCap False v0 v1 f; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>\<rbrakk> \<Longrightarrow> ((getFreeRef v0 prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26 = (getFreeRef v0 prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte' d v0 v1 f i. \<lbrakk>f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = ((v0 + word_of_nat prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capability.UntypedCap False v0 v1 prior_idx; cteCap cte = capability.UntypedCap False v0 v1 f; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat prior_idx - 1 && ~~ mask resetChunkBits\<rbrakk> \<Longrightarrow> ((v0 + word_of_nat prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26 = (v0 + word_of_nat prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte' d v0 v1 f i. \<lbrakk>f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = ((v0 + word_of_nat prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capability.UntypedCap False v0 v1 prior_idx; cteCap cte = capability.UntypedCap False v0 v1 f; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat prior_idx - 1 && ~~ mask resetChunkBits; word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1\<rbrakk> \<Longrightarrow> ((v0 + word_of_nat prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26 = (v0 + word_of_nat prior_idx - 1 && ~~ mask resetChunkBits) - v0 >> 4
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx ret__struct_cap_C sa ctea cte' d v0 v1 f i. \<lbrakk>f < 2147483648; is_aligned (word_of_nat f) 4; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; cap_untyped_cap_lift ret__struct_cap_C = \<lparr>capFreeIndex_CL = (word_of_nat prior_idx - 1 && ~~ mask resetChunkBits >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cslift sa (cte_Ptr slot) = Some cte'; cteCap ctea = capability.UntypedCap False v0 v1 prior_idx; cteCap cte = capability.UntypedCap False v0 v1 f; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_lift (cte_C.cap_C cte') = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift (cte_C.cap_C cte') = \<lparr>capFreeIndex_CL = word_of_nat prior_idx >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat prior_idx - 1 && ~~ mask resetChunkBits; word_of_nat prior_idx - 1 && ~~ mask resetChunkBits < 2 ^ v1; is_aligned v0 v1; v1 < word_bits; valid_untyped' False v0 v1 f s; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> (word_of_nat prior_idx - 1 && ~~ mask resetChunkBits >> 4) && mask 26 = word_of_nat prior_idx - 1 && ~~ mask resetChunkBits >> 4
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (18 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv' t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))) (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (?d'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rv')
 3. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 4. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 5. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 7. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 8. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 9. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 10. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
A total of 18 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (17 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] preemptionPoint (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))))
 2. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 4. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 5. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 6. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 7. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 8. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 9. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 10. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
A total of 17 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (17 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva) (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv') [SKIP] (preemptionPoint >>=E returnOk) (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP))))
 2. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>?Q7435 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C\<rbrace>
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'7435 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C)
 4. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 5. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 6. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 7. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 8. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 9. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 10. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
A total of 17 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (20 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' rvb status. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'; dc rvb (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?Q7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' rvb) (?Q'7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' rvb status) [SKIP] (returnOk rvb) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err rv'a status. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'a) status\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?QE7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err) (?Q''7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err rv'a status) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'a)
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))
 3. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva\<rbrace> preemptionPoint \<lbrace>?Q7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'\<rbrace>, \<lbrace>?QE7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'\<rbrace>
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv') \<acute>status :== CALL preemptionPoint_'proc() {sa. (id (status_' sa) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (status_' sa)) \<longrightarrow> sa \<in> ?Q'7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv' rvb (status_' sa))) \<and> (id (status_' sa) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' sa)) (errstate sa) \<longrightarrow> sa \<in> ?Q''7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv' err (status_' sa) (errstate sa)))}
 5. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>\<lambda>a. invs' and ?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C a\<rbrace>
 6. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> ?R'7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv')
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 8. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 9. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 10. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
A total of 20 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (20 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' rvb status. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'; dc rvb (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk rvb \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel dc rv (xfdc s)}
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err rv'a status. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'a) status\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?QE7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err) (?Q''7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err rv'a status) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'a)
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))
 3. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'\<rbrace>
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv') \<acute>status :== CALL preemptionPoint_'proc() {sa. (id (status_' sa) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' sa)) \<longrightarrow> sa \<in> UNIV)) \<and> (id (status_' sa) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' sa)) (errstate sa) \<longrightarrow> sa \<in> ?Q''7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv' err (status_' sa) (errstate sa)))}
 5. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>\<lambda>a. invs' and ?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C a\<rbrace>
 6. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> ?R'7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv')
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 8. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 9. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 10. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
A total of 20 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (20 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' rvb status \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'; dc rvb (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False) \<and> (\<not> status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> True \<and> True \<and> (\<exists>(rv, \<sigma>')\<in>fst (returnOk rvb \<sigma>). (\<sigma>', s\<lparr>offset___unsigned_long_' := (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100\<rparr>) \<in> rf_sr \<and> inr_rrel dc rv (xfdc (s\<lparr>offset___unsigned_long_' := (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100\<rparr>))))}
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err rv'a status. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'a) status\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?QE7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err) (?Q''7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err rv'a status) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'a)
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))
 3. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'\<rbrace>
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv') \<acute>status :== CALL preemptionPoint_'proc() {sa. (id (status_' sa) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' sa)) \<longrightarrow> sa \<in> UNIV)) \<and> (id (status_' sa) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' sa)) (errstate sa) \<longrightarrow> sa \<in> ?Q''7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv' err (status_' sa) (errstate sa)))}
 5. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>\<lambda>a. invs' and ?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C a\<rbrace>
 6. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> ?R'7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv')
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 8. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 9. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 10. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
A total of 20 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err rv'a status. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'a) status\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_') (?QE7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err) (?Q''7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv' err rv'a status) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'a)
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)))
 2. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'\<rbrace>
 3. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv') \<acute>status :== CALL preemptionPoint_'proc() {sa. (id (status_' sa) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' sa)) \<longrightarrow> sa \<in> UNIV)) \<and> (id (status_' sa) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' sa)) (errstate sa) \<longrightarrow> sa \<in> ?Q''7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv' err (status_' sa) (errstate sa)))}
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>\<lambda>a. invs' and ?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C a\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> ?R'7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv')
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv' err rv'a status. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'a) status\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv'a)
FI;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP)) {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inl_rrel (cintr \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' s)}
 2. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv') \<acute>status :== CALL preemptionPoint_'proc() {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> UNIV)) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>\<lambda>a. invs' and ?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C a\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> ?R'7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv')
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (19 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv' err rv'a status \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'a) status\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := rv'a, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> inl_rrel (cintr \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := rv'a, global_exn_var_' := Return\<rparr>)))) \<and> (\<not> rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False)}
 2. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv') \<acute>status :== CALL preemptionPoint_'proc() {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> UNIV)) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 4. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>\<lambda>a. invs' and ?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C a\<rbrace>
 5. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> ?R'7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv')
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 7. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 8. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 9. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 10. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
A total of 19 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (18 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva\<rbrace> preemptionPoint \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv') \<acute>status :== CALL preemptionPoint_'proc() {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> UNIV)) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 3. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>\<lambda>a. invs' and ?R7594 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C a\<rbrace>
 4. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> ?R'7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv')
 5. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 6. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 7. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 8. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 9. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 10. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
A total of 18 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (17 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; dc rva rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7590 cte prev_cap s prior_idx rv xfdc ret__struct_cap_C rva rv') \<acute>status :== CALL preemptionPoint_'proc() {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> UNIV)) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 2. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> ?R'7590 cte prev_cap s prior_idx rv xfdca ret__struct_cap_C rva rv')
 4. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 5. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 6. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 7. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 8. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 9. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 10. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
A total of 17 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (16 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdc ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdc; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7439 cte prev_cap s prior_idx ()\<rbrace> updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and ?R7439 cte prev_cap s prior_idx a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 4. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 5. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 6. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 7. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 8. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 9. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 10. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
A total of 16 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (15 subgoals):
 1. \<And>cte prev_cap s prior_idx rv xfdca ret__struct_cap_C. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; dc rv xfdca; cap_untyped_cap_lift ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. {s. s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and (\<lambda>a. (invs' a \<and> (\<exists>ptr sz. pspace_no_overlap' ptr sz a \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ sz \<and> cte_wp_at' ((\<lambda>c. isUntypedCap c \<and> capPtr c = ptr \<and> capBlockSize c = sz) \<circ> cteCap) slot a) \<and> is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of a) = {}) \<and> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 3. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 4. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 5. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 6. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 7. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 8. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 9. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 10. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
A total of 15 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (14 subgoals):
 1. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<lbrace>?R7182 cte prev_cap s prior_idx\<rbrace> doMachineOp (clearMemory (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits)) \<lbrace>\<lambda>a. valid_objs' and cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap ctea) slot and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) and (\<lambda>a. (invs' a \<and> (\<exists>ptr sz. pspace_no_overlap' ptr sz a \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ sz \<and> cte_wp_at' ((\<lambda>c. isUntypedCap c \<and> capPtr c = ptr \<and> capBlockSize c = sz) \<circ> cteCap) slot a) \<and> is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of a) = {}) \<and> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 2. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 3. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and ?R7182 cte prev_cap s prior_idx) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 4. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 5. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 6. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 9. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. cap_untyped_cap_lift v = cap_untyped_cap_lift (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)))\<lparr>capFreeIndex_CL := v32_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s)) && mask 26\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. s \<in> {s. \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (v32_'_update (\<lambda>_. (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) (cap_'_update (\<lambda>_. prev_cap) s))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and (\<lambda>s. valid_objs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap a) slot s \<and> untyped_ranges_zero' s \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) \<and> invs' s \<and> (\<exists>x xa. (pspace_no_overlap' x xa s \<and> pspace_aligned' s \<and> pspace_distinct' s) \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ xa \<and> cte_wp_at' ((\<lambda>c. isUntypedCap c \<and> capPtr c = x \<and> capBlockSize c = xa) \<circ> cteCap) slot s) \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of s) = {}) \<and> (True \<and> True) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) s)) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s prior_idx. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7182 cte prev_cap s prior_idx) CALL clearMemory_'proc(PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits),8) {s. (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0}
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and (\<lambda>s. valid_objs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap a) slot s \<and> untyped_ranges_zero' s \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) \<and> invs' s \<and> (\<exists>x xa. (pspace_no_overlap' x xa s \<and> pspace_aligned' s \<and> pspace_distinct' s) \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ xa \<and> cte_wp_at' ((\<lambda>c. isUntypedCap c \<and> capPtr c = x \<and> capBlockSize c = xa) \<circ> cteCap) slot s) \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of s) = {}) \<and> (True \<and> True) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) s)) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> ?R'7182 cte prev_cap s prior_idx
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; ((\<lambda>a. 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> invs' a \<and> descendants_of' slot (ctes_of a) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) a) and cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot) sa; s' \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>True\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and (\<lambda>s. valid_objs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap a) slot s \<and> untyped_ranges_zero' s \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) \<and> invs' s \<and> (\<exists>x xa. (pspace_no_overlap' x xa s \<and> pspace_aligned' s \<and> pspace_distinct' s) \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ xa \<and> cte_wp_at' ((\<lambda>c. isUntypedCap c \<and> capPtr c = x \<and> capBlockSize c = xa) \<circ> cteCap) slot s) \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of s) = {}) \<and> (True \<and> True) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) s)) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and (\<lambda>s. valid_objs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap a) slot s \<and> untyped_ranges_zero' s \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) \<and> invs' s \<and> (\<exists>x xa. (pspace_no_overlap' x xa s \<and> pspace_aligned' s \<and> pspace_distinct' s) \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ xa \<and> cte_wp_at' ((\<lambda>c. isUntypedCap c \<and> capPtr c = x \<and> capBlockSize c = xa) \<circ> cteCap) slot s) \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of s) = {}) \<and> (True \<and> True) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) s)) sa \<and> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> resetChunkBits \<le> resetChunkBits) and (\<lambda>s. valid_objs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte) = cteCap a) slot s \<and> untyped_ranges_zero' s \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) 4 \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ capBlockSize (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte))) \<and> invs' s \<and> (\<exists>x xa. (pspace_no_overlap' x xa s \<and> pspace_aligned' s \<and> pspace_distinct' s) \<and> getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) \<le> 2 ^ xa \<and> cte_wp_at' ((\<lambda>c. isUntypedCap c \<and> capPtr c = x \<and> capBlockSize c = xa) \<circ> cteCap) slot s) \<and> (is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of s) = {}) \<and> (True \<and> True) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) s)) sa
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s sa s' d ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> getFreeRef v0 f - 1; getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits \<in> set [v0 , v0 + 2 ^ resetChunkBits .e. getFreeRef v0 f - 1]; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'\<rbrakk> \<Longrightarrow> {getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> {v0..v0 + 2 ^ v1 - 1} \<and> 2 \<le> resetChunkBits \<and> is_aligned ((getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits) - v0) 4 \<and> unat ((getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits) - v0) \<le> 2 ^ v1 \<and> is_aligned ((getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits) - v0) 4
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s sa s' d ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> getFreeRef v0 f - 1; getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits \<in> set [v0 , v0 + 2 ^ resetChunkBits .e. getFreeRef v0 f - 1]; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; kernel_data_refs \<inter> capRange (cteCap ctea) = {} \<and> global_refs' sa \<subseteq> kernel_data_refs \<and> 2 ^ capBits (cteCap ctea) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> {getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> {v0..v0 + 2 ^ v1 - 1} \<and> 2 \<le> resetChunkBits \<and> is_aligned ((getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits) - v0) 4 \<and> unat ((getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits) - v0) \<le> 2 ^ v1 \<and> is_aligned ((getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits) - v0) 4
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s sa s' d ctea v0 v1 f idx' i. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; global_refs' sa \<subseteq> kernel_data_refs; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; 2 ^ v1 \<le> gsMaxObjectSize sa; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> is_aligned ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) 4 \<and> unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) \<le> 2 ^ v1 \<and> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> {v0..v0 + 2 ^ v1 - 1}
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s sa s' d ctea v0 v1 f idx' i. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; global_refs' sa \<subseteq> kernel_data_refs; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; 2 ^ v1 \<le> gsMaxObjectSize sa; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> is_aligned ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) 4 \<and> unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) \<le> 2 ^ v1 \<and> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> {v0..v0 + 2 ^ v1 - 1}
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s sa s' d ctea v0 v1 f idx' i. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; global_refs' sa \<subseteq> kernel_data_refs; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 && ~~ mask resetChunkBits; 2 ^ v1 \<le> gsMaxObjectSize sa; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; word_of_nat idx' - 1 && ~~ mask resetChunkBits < 2 ^ v1; is_aligned v0 v1; v1 < word_bits; valid_untyped' False v0 v1 f s; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> is_aligned (word_of_nat idx' - 1 && ~~ mask resetChunkBits) 4 \<and> unat (word_of_nat idx' - 1 && ~~ mask resetChunkBits) \<le> 2 ^ v1 \<and> {v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits)..+2 ^ resetChunkBits} \<subseteq> {v0..v0 + 2 ^ v1 - 1}
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s sa s' d ctea v0 v1 f idx' i. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; global_refs' sa \<subseteq> kernel_data_refs; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 && ~~ mask resetChunkBits; 2 ^ v1 \<le> gsMaxObjectSize sa; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; word_of_nat idx' - 1 && ~~ mask resetChunkBits < 2 ^ v1; is_aligned v0 v1; v1 < word_bits; valid_untyped' False v0 v1 f s; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 4 \<le> resetChunkBits \<and> word_of_nat idx' - 1 && ~~ mask resetChunkBits \<le> word_of_nat (2 ^ v1) \<and> is_aligned v0 v1 \<and> is_aligned (word_of_nat idx' - 1 && ~~ mask resetChunkBits) resetChunkBits \<and> resetChunkBits \<le> v1 \<and> word_of_nat idx' - 1 && ~~ mask resetChunkBits < 2 ^ v1
 2. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s prior_idx sa s'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) s; (sa, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. capFreeIndex (cteCap cte) = prior_idx) slot sa; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s'; True; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) sa\<rbrakk> \<Longrightarrow> s' \<in> {s. bits_'_update (\<lambda>_. 8) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rparr>) \<in> {s. region_actually_is_bytes (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s} \<inter> \<lbrace>\<acute>bits = word_of_nat resetChunkBits\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)\<rbrace>} \<inter> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) (replicate (unat (1 << unat 8)) (UCAST(?'a7964 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits) - capPtr (cteCap cte) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> \<not> capIsDevice (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) \<longrightarrow> region_actually_is_bytes (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) t \<and> heap_list (hrs_mem \<^bsup>ta\<^esup>t_hrs) (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) (capPtr (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) + word_of_nat (getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits))) = replicate (capFreeIndex (capFreeIndex_update (\<lambda>_. prior_idx) (cteCap cte)) - getFreeIndex (capPtr (cteCap cte)) (getFreeRef (capPtr (cteCap cte)) prior_idx - 1 && ~~ mask resetChunkBits)) 0)))\<rbrace>
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'\<rbrakk> \<Longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s' \<and> word_of_nat resetChunkBits = 8 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<noteq> 0 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<le> (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) + 0xFF \<and> is_aligned (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) 2 \<and> is_aligned 0x100 2 \<and> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+256} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s'))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s')) = 0 \<or> 0x100 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s'))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits)) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals t)) \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) = replicate (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) 0))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; kernel_data_refs \<inter> capRange (cteCap ctea) = {} \<and> global_refs' sa \<subseteq> kernel_data_refs \<and> 2 ^ capBits (cteCap ctea) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s' \<and> word_of_nat resetChunkBits = 8 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<noteq> 0 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<le> (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) + 0xFF \<and> is_aligned (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) 2 \<and> is_aligned 0x100 2 \<and> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+256} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s'))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s')) = 0 \<or> 0x100 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s'))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits)) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals t)) \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) = replicate (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) 0))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {} \<and> global_refs' sa \<subseteq> kernel_data_refs \<and> 2 ^ v1 \<le> gsMaxObjectSize sa; word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1\<rbrakk> \<Longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s' \<and> word_of_nat resetChunkBits = 8 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<noteq> 0 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<le> (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) + 0xFF \<and> is_aligned (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) 2 \<and> is_aligned 0x100 2 \<and> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+256} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s'))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s')) = 0 \<or> 0x100 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s'))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits)) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals t)) \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) = replicate (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) 0))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) s; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1; valid_cap' (cteCap ctea) sa; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s' \<and> word_of_nat resetChunkBits = 8 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<noteq> 0 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<le> (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) + 0xFF \<and> is_aligned (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) 2 \<and> is_aligned 0x100 2 \<and> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+256} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s'))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s')) = 0 \<or> 0x100 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s'))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits)) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals t)) \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) = replicate (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) 0))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; capAligned (capability.UntypedCap False v0 v1 f); capAligned (capability.UntypedCap False v0 v1 idx'); valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (2 ^ resetChunkBits) s' \<and> word_of_nat resetChunkBits = 8 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<noteq> 0 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<le> (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) + 0xFF \<and> is_aligned (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) 2 \<and> is_aligned 0x100 2 \<and> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+256} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s'))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s')) = 0 \<or> 0x100 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s'))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits)) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals t)) \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> region_actually_is_bytes (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) = replicate (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) 0))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); v0 + word_of_nat i * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; capAligned (capability.UntypedCap False v0 v1 f); capAligned (capability.UntypedCap False v0 v1 idx'); valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+2 ^ resetChunkBits} \<subseteq> {v0..+2 ^ v1} \<and> word_of_nat resetChunkBits = 8 \<and> v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits \<noteq> 0 \<and> 8 \<le> resetChunkBits \<and> 2 \<le> resetChunkBits \<and> is_aligned 0x100 resetChunkBits \<and> 2 \<le> resetChunkBits \<and> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+256} \<subseteq> {v0..+2 ^ v1} \<and> 256 \<le> gsMaxObjectSize sa \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits)) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0 >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> {v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits..+idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)} \<subseteq> {v0..+2 ^ v1} \<and> heap_list (hrs_mem (t_hrs_' (globals x))) (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) = replicate (idx' - unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0)) 0))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 && ~~ mask resetChunkBits; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat idx' - 1 && ~~ mask resetChunkBits < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> {v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits)..+2 ^ resetChunkBits} \<subseteq> {v0..+2 ^ v1} \<and> {v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits)..+256} \<subseteq> {v0..+2 ^ v1} \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits)) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits)) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat idx' - 1 && ~~ mask resetChunkBits >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> {v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits)..+idx' - unat (word_of_nat idx' - 1 && ~~ mask resetChunkBits)} \<subseteq> {v0..+2 ^ v1} \<and> heap_list (hrs_mem (t_hrs_' (globals x))) (idx' - unat (word_of_nat idx' - 1 && ~~ mask resetChunkBits)) (v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits)) = replicate (idx' - unat (word_of_nat idx' - 1 && ~~ mask resetChunkBits)) 0))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 && ~~ mask resetChunkBits; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat idx' - 1 && ~~ mask resetChunkBits < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits)) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 && ~~ mask resetChunkBits)) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat idx' - 1 && ~~ mask resetChunkBits >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> idx' - unat (word_of_nat idx' - 1 && ~~ mask resetChunkBits) \<le> 2 ^ resetChunkBits \<and> 256 \<le> addr_card \<and> idx' - unat (word_of_nat idx' - 1 && ~~ mask resetChunkBits) \<le> 256 \<and> idx' - unat (word_of_nat idx' - 1 && ~~ mask resetChunkBits) \<le> 2 ^ resetChunkBits))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits \<and> 256 \<le> addr_card \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 256 \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits; idx' = 0\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits \<and> 256 \<le> addr_card \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 256 \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits))
 2. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx' nat. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits; idx' = Suc nat\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits \<and> 256 \<le> addr_card \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 256 \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits))
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits; idx' = 0\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits \<and> 256 \<le> addr_card \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 256 \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits))
 2. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx' nat. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits; idx' = Suc nat\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits \<and> 256 \<le> addr_card \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 256 \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits))
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (13 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = - 1 - mask resetChunkBits; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 0; - 1 - mask resetChunkBits < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 0 sa; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (- 1 - mask resetChunkBits)) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (- 1 - mask resetChunkBits))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (- 1 - mask resetChunkBits)) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (- 1 - mask resetChunkBits >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> 256 \<le> addr_card))
 2. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx' nat. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits; idx' = Suc nat\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits \<and> 256 \<le> addr_card \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 256 \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits))
 3. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 4. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 5. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 8. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 10. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f idx' nat. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 idx'; word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 idx' sa; v0 \<noteq> 0; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits; idx' = Suc nat\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat idx' - 1 - (word_of_nat idx' - 1 && mask resetChunkBits) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits \<and> 256 \<le> addr_card \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 256 \<and> idx' - (unat (word_of_nat idx' - 1) - unat (word_of_nat idx' - 1 && mask resetChunkBits)) \<le> 2 ^ resetChunkBits))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f nat. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 2 ^ resetChunkBits \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits = word_of_nat nat - (word_of_nat nat && mask resetChunkBits); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 (Suc nat); word_of_nat nat - (word_of_nat nat && mask resetChunkBits) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 (Suc nat) sa; v0 \<noteq> 0; Suc nat \<le> 2 ^ v1; is_aligned (1 + word_of_nat nat) 4; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> resetChunkBits \<and> word_of_nat resetChunkBits = 8 \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize sa \<and> 256 \<le> 2 ^ resetChunkBits \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - (word_of_nat nat && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat nat - (word_of_nat nat && mask resetChunkBits)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - (word_of_nat nat && mask resetChunkBits))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat nat - (word_of_nat nat && mask resetChunkBits) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> Suc nat - (unat (word_of_nat nat) - unat (word_of_nat nat && mask resetChunkBits)) \<le> 2 ^ resetChunkBits \<and> 256 \<le> addr_card \<and> Suc nat - (unat (word_of_nat nat) - unat (word_of_nat nat && mask resetChunkBits)) \<le> 256 \<and> Suc nat - (unat (word_of_nat nat) - unat (word_of_nat nat && mask resetChunkBits)) \<le> 2 ^ resetChunkBits))
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f nat. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; 16 dvd unat (word_of_nat f); cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; 8 \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 256 \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 0x100); word_of_nat i * 0x100 = word_of_nat nat - (word_of_nat nat && mask 8); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 (Suc nat); word_of_nat nat - (word_of_nat nat && mask 8) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 (Suc nat) sa; v0 \<noteq> 0; Suc nat \<le> 2 ^ v1; 16 dvd unat (1 + word_of_nat nat); v1 \<le> 29; f \<le> 2 ^ v1; 2 ^ v1 dvd unat v0; v1 < word_bits\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - (word_of_nat nat && mask 8))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat nat - (word_of_nat nat && mask 8)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - (word_of_nat nat && mask 8))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat nat - (word_of_nat nat && mask 8) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> Suc nat - (unat (word_of_nat nat) - unat (word_of_nat nat && mask 8)) \<le> 256)
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f nat. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; 16 dvd f; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; 8 \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 256 \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 0x100); word_of_nat i * 0x100 = word_of_nat nat - (word_of_nat nat && mask 8); ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 (Suc nat); word_of_nat nat - (word_of_nat nat && mask 8) < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 (Suc nat) sa; v0 \<noteq> 0; Suc nat \<le> 2 ^ v1; 16 dvd unat (1 + word_of_nat nat); v1 \<le> 29; f \<le> 2 ^ v1; 2 ^ v1 dvd unat v0; v1 < word_bits\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - (word_of_nat nat && mask 8))) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat nat - (word_of_nat nat && mask 8)))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - (word_of_nat nat && mask 8))) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat nat - (word_of_nat nat && mask 8) >> 4) && mask 26, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> Suc nat - (nat - unat (word_of_nat nat && mask 8)) \<le> 256)
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f nat. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; 16 dvd f; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; 8 \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 256 \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 0x100); word_of_nat i * 0x100 = word_of_nat nat - word_of_nat nat mod 0x100; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 (Suc nat); word_of_nat nat - word_of_nat nat mod 0x100 < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 (Suc nat) sa; v0 \<noteq> 0; Suc nat \<le> 2 ^ v1; 16 dvd unat (1 + word_of_nat nat); v1 \<le> 29; f \<le> 2 ^ v1; 2 ^ v1 dvd unat v0; v1 < word_bits\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - word_of_nat nat mod 0x100)) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat nat - word_of_nat nat mod 0x100))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - word_of_nat nat mod 0x100)) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat nat - word_of_nat nat mod 0x100 >> 4) mod 0x4000000, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> nat mod 256 \<le> 255)
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap s sa s' d i ctea v0 v1 f nat. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; 16 dvd f; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; 8 \<le> v1; unat v0 \<le> unat (v0 + word_of_nat f - 1); \<not> d; (sa, s') \<in> rf_sr; region_actually_is_bytes v0 (2 ^ v1) s'; 256 \<le> gsMaxObjectSize sa; invs' sa; descendants_of' slot (ctes_of sa) = {}; pspace_no_overlap' v0 v1 sa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 0x100); word_of_nat i * 0x100 = word_of_nat nat - word_of_nat nat mod 0x100; ctes_of sa slot = Some ctea; cteCap ctea = capability.UntypedCap False v0 v1 (Suc nat); word_of_nat nat - word_of_nat nat mod 0x100 < 2 ^ v1; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' sa \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize sa; valid_untyped' False v0 v1 f s; valid_untyped' False v0 v1 (Suc nat) sa; v0 \<noteq> 0; Suc nat \<le> 2 ^ v1; 16 dvd unat (1 + word_of_nat nat); v1 \<le> 29; f \<le> 2 ^ v1; 2 ^ v1 dvd unat v0; v1 < word_bits\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - word_of_nat nat mod 0x100)) (replicate 256 0)) (t_hrs_' (globals s'))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (v0 + (word_of_nat nat - word_of_nat nat mod 0x100))) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = hrs_htd (t_hrs_' (globals s')) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list (v0 + (word_of_nat nat - word_of_nat nat mod 0x100)) (replicate 256 0)) (t_hrs_' (globals s'))) (t_hrs_' (globals x)) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_untyped_cap_lift v = \<lparr>capFreeIndex_CL = (word_of_nat nat - word_of_nat nat mod 0x100 >> 4) mod 0x4000000, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>) \<longrightarrow> 0 < 256 \<and> 256 - Suc 0 \<le> 255)
 2. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 3. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap rv' s \<sigma>. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); s \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s}; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]). \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) (capPtr (cteCap cte) + (x - capPtr (cteCap cte))),8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 2. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap s \<sigma> x xa. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr; x \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) xa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} CALL clearMemory_'proc(PTR(32 word) x,8);;
\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(prev_cap,x - capPtr (cteCap cte) >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>offset___unsigned_long :== x - capPtr (cteCap cte) - 0x100));;
Guard ShiftError UNIV (Guard ShiftError UNIV SKIP) {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s},UNIV
 2. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap s \<sigma> x xa. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr; x \<in> set [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; \<not> capIsDevice (cteCap cte); valid_cap' (cteCap cte) xa\<rbrakk> \<Longrightarrow> {s} \<subseteq> \<lbrace>8 < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) x)) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) x)) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) x)) + ((1 << unat 8) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) x))) 2 \<and> is_aligned (1 << unat 8) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) x))..+unat (1 << unat 8)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) \<acute>ghost'state \<in> insert 0 {1 << unat 8..} \<and> (\<forall>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) x))) (replicate (unat (1 << unat 8)) (UCAST(?'a8410 \<rightarrow> 8) 0))) \<acute>t_hrs \<longrightarrow> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) x))) \<longrightarrow> (\<forall>ta. hrs_htd \<^bsup>ta\<^esup>t_hrs = hrs_htd \<^bsup>t\<^esup>t_hrs \<and> byte_regions_unmodified \<^bsup>t\<^esup>t_hrs \<^bsup>ta\<^esup>t_hrs \<longrightarrow> cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>tb. cap_untyped_cap_lift \<^bsup>tb\<^esup>ret__struct_cap_C = cap_untyped_cap_lift prev_cap\<lparr>capFreeIndex_CL := (x - capPtr (cteCap cte) >> 4) && mask 26\<rparr> \<and> cap_get_tag \<^bsup>tb\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr slot \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> region_actually_is_bytes' (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<^bsup>tb\<^esup>ret__struct_cap_C) \<^bsup>ta\<^esup>t_hrs)))))))\<rbrace>
 2. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap s \<sigma> xa d i v0 v1 f. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; region_actually_is_bytes v0 (2 ^ v1) s; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) xa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> v0 + word_of_nat i * 2 ^ resetChunkBits \<noteq> 0 \<and> v0 + word_of_nat i * 2 ^ resetChunkBits \<le> v0 + word_of_nat i * 2 ^ resetChunkBits + 0xFF \<and> is_aligned (v0 + word_of_nat i * 2 ^ resetChunkBits) 2 \<and> is_aligned 0x100 2 \<and> {v0 + word_of_nat i * 2 ^ resetChunkBits..+256} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 0x100 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)))
 2. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap s \<sigma> xa d i v0 v1 f. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; region_actually_is_bytes v0 (2 ^ v1) s; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) xa; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1\<rbrakk> \<Longrightarrow> v0 + word_of_nat i * 2 ^ resetChunkBits \<noteq> 0 \<and> v0 + word_of_nat i * 2 ^ resetChunkBits \<le> v0 + word_of_nat i * 2 ^ resetChunkBits + 0xFF \<and> is_aligned (v0 + word_of_nat i * 2 ^ resetChunkBits) 2 \<and> is_aligned 0x100 2 \<and> {v0 + word_of_nat i * 2 ^ resetChunkBits..+256} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 0x100 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)))
 2. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap s \<sigma> xa d i v0 v1 f. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; region_actually_is_bytes v0 (2 ^ v1) s; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr; \<not> d; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1; capAligned (capability.UntypedCap False v0 v1 f); valid_untyped' False v0 v1 f xa; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> v0 + word_of_nat i * 2 ^ resetChunkBits \<noteq> 0 \<and> v0 + word_of_nat i * 2 ^ resetChunkBits \<le> v0 + word_of_nat i * 2 ^ resetChunkBits + 0xFF \<and> is_aligned (v0 + word_of_nat i * 2 ^ resetChunkBits) 2 \<and> is_aligned 0x100 2 \<and> {v0 + word_of_nat i * 2 ^ resetChunkBits..+256} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 0x100 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)))
 2. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap s \<sigma> xa d i v0 v1 f. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; region_actually_is_bytes v0 (2 ^ v1) s; 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr; \<not> d; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1; capAligned (capability.UntypedCap False v0 v1 f); valid_untyped' False v0 v1 f xa; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> v0 + word_of_nat i * 2 ^ resetChunkBits \<noteq> 0 \<and> is_aligned (v0 + word_of_nat i * 2 ^ resetChunkBits) resetChunkBits \<and> 8 \<le> resetChunkBits \<and> is_aligned (v0 + word_of_nat i * 2 ^ resetChunkBits) resetChunkBits \<and> 2 \<le> resetChunkBits \<and> is_aligned 0x100 resetChunkBits \<and> 2 \<le> resetChunkBits \<and> is_aligned v0 v1 \<and> 8 \<le> resetChunkBits \<and> 8 \<le> v1 \<and> 256 \<le> gsMaxObjectSize \<sigma>
 2. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap s \<sigma> xa d i v0 v1 f. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; \<forall>x\<in>{v0..+2 ^ v1}. hrs_htd (t_hrs_' (globals s)) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); 2 ^ resetChunkBits \<le> gsMaxObjectSize \<sigma>; (\<sigma>, s) \<in> rf_sr; \<not> d; cteCap cte = capability.UntypedCap False v0 v1 f; i \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); word_of_nat i * 2 ^ resetChunkBits < 2 ^ v1; valid_untyped' False v0 v1 f xa; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned v0 v1; v1 < word_bits\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits \<and> 8 \<le> v1 \<and> 8 \<le> resetChunkBits \<and> is_aligned 0x100 resetChunkBits \<and> 256 \<le> gsMaxObjectSize \<sigma>
 2. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap rv' n. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1])\<rbrakk> \<Longrightarrow> \<lbrace>?P'8551 cte prev_cap rv' n\<rbrace> do y <- doMachineOp (clearMemory (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n));
preemptionPoint
od \<lbrace>\<lambda>_. (\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))\<rbrace>, -
 2. \<And>cte prev_cap rv' n s. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte); Suc n < length (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]); ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) s\<rbrakk> \<Longrightarrow> ?P'8551 cte prev_cap rv' n s
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1; Ex (valid_cap' (cteCap cte)) \<and> \<not> capIsDevice (cteCap cte); Suc n < length [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]; 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot s \<and> invs' s \<and> descendants_of' slot (ctes_of s) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>a. \<exists>idx'. capFreeIndex_update (\<lambda>_. getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n)) (cteCap a) = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot s \<and> (\<exists>x xa. pspace_no_overlap' x xa s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) \<le> 2 ^ xa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xa) slot s) \<and> is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n))) 4 \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot s \<and> cte_wp_at' (\<lambda>a. \<exists>idx'. capFreeIndex_update (\<lambda>_. getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n)) (cteCap a) = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! Suc n = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot s \<and> (\<exists>x xa. pspace_no_overlap' x xa s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n) \<le> 2 ^ xa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xa) slot s) \<and> is_aligned (word_of_nat (getFreeIndex (capPtr (cteCap cte)) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! n))) 4 \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot s
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> getFreeRef v0 f - 1; Suc n < length [v0 , v0 + 2 ^ resetChunkBits .e. getFreeRef v0 f - 1]; cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) x; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; rev [v0 , v0 + 2 ^ resetChunkBits .e. getFreeRef v0 f - 1] ! n = getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits\<rbrakk> \<Longrightarrow> rev [v0 , v0 + 2 ^ resetChunkBits .e. getFreeRef v0 f - 1] ! Suc n = getFreeRef v0 (getFreeIndex v0 (getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits)) - 1 && ~~ mask resetChunkBits \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> getFreeIndex v0 (getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits) \<le> 2 ^ v1 \<and> is_aligned (word_of_nat (getFreeIndex v0 (getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits))) 4 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_pspace' s \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. getFreeRef v0 f - 1] ! Suc n = getFreeRef v0 (getFreeIndex v0 (getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits)) - 1 && ~~ mask resetChunkBits \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> getFreeIndex v0 (getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits) \<le> 2 ^ v1 \<and> is_aligned (word_of_nat (getFreeIndex v0 (getFreeRef v0 idx' - 1 && ~~ mask resetChunkBits))) 4 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_pspace' s
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) x; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; v0 + ((word_of_nat f - 1) div 2 ^ resetChunkBits - word_of_nat n) * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits\<rbrakk> \<Longrightarrow> is_aligned ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) 4 \<and> unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) \<le> 2 ^ v1 \<and> v0 + ((word_of_nat f - 1) div 2 ^ resetChunkBits - (1 + word_of_nat n)) * 2 ^ resetChunkBits = (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - 1 && ~~ mask resetChunkBits
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) x; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; v0 + ((word_of_nat f - 1) div 2 ^ resetChunkBits - word_of_nat n) * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits < 2 ^ v1\<rbrakk> \<Longrightarrow> is_aligned ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) 4 \<and> unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) \<le> 2 ^ v1 \<and> v0 + ((word_of_nat f - 1) div 2 ^ resetChunkBits - (1 + word_of_nat n)) * 2 ^ resetChunkBits = (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - 1 && ~~ mask resetChunkBits
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; v1 < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; valid_cap' (capability.UntypedCap False v0 v1 f) x; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; v0 + ((word_of_nat f - 1) div 2 ^ resetChunkBits - word_of_nat n) * 2 ^ resetChunkBits = v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits; (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits < 2 ^ v1; valid_cap' (cteCap ctea) s\<rbrakk> \<Longrightarrow> is_aligned ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) 4 \<and> unat ((v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - v0) \<le> 2 ^ v1 \<and> v0 + ((word_of_nat f - 1) div 2 ^ resetChunkBits - (1 + word_of_nat n)) * 2 ^ resetChunkBits = (v0 + word_of_nat idx' - 1 && ~~ mask resetChunkBits) - 1 && ~~ mask resetChunkBits
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; ((word_of_nat f - 1) div 2 ^ resetChunkBits - word_of_nat n) * 2 ^ resetChunkBits = word_of_nat idx' - 1 && ~~ mask resetChunkBits; (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits < 2 ^ v1; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat idx' - 1 && ~~ mask resetChunkBits) 4 \<and> unat (word_of_nat idx' - 1 && ~~ mask resetChunkBits) \<le> 2 ^ v1 \<and> ((word_of_nat f - 1) div 2 ^ resetChunkBits - (1 + word_of_nat n)) * 2 ^ resetChunkBits = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) - 2 ^ resetChunkBits
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits < 2 ^ v1; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat idx' - 1 && ~~ mask resetChunkBits) 4 \<and> unat (word_of_nat idx' - 1 && ~~ mask resetChunkBits) \<le> 2 ^ v1
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits < 2 ^ v1; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> 4 \<le> resetChunkBits \<and> word_of_nat idx' - 1 && ~~ mask resetChunkBits \<le> word_of_nat (2 ^ v1)
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits < 2 ^ v1; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> word_of_nat idx' - 1 && ~~ mask resetChunkBits \<le> 2 ^ v1
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> word_of_nat n * 2 ^ resetChunkBits \<le> (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits) * unat (2 ^ resetChunkBits) < 2 ^ LENGTH(32)
 2. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits \<le> (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat (word_of_nat f - 1 >> resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * (word_of_nat f - 1 >> resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> unat (word_of_nat f - 1 >> resetChunkBits) * 2 ^ resetChunkBits < 2 ^ word_bits
 2. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits \<le> (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat (word_of_nat f - 1 >> resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * (word_of_nat f - 1 >> resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> unat (word_of_nat f - 1 >> resetChunkBits) < 2 ^ (word_bits - resetChunkBits)
 2. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat (word_of_nat f - 1 >> resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * (word_of_nat f - 1 >> resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> resetChunkBits \<le> word_bits
 3. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits \<le> (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (12 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat (word_of_nat f - 1 >> resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * (word_of_nat f - 1 >> resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> 2 ^ (LENGTH(32) - resetChunkBits) \<le> 2 ^ (word_bits - resetChunkBits)
 2. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat (word_of_nat f - 1 >> resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * (word_of_nat f - 1 >> resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> resetChunkBits \<le> word_bits
 3. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits \<le> (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits
 4. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 7. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 9. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 10. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (11 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat (word_of_nat f - 1 >> resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * (word_of_nat f - 1 >> resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> resetChunkBits \<le> word_bits
 2. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits \<le> (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits
 3. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 6. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 8. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 9. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 10. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals...
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (10 subgoals):
 1. \<And>cte prev_cap n s d v0 v1 f x ctea idx'. \<lbrakk>ccap_relation (capability.UntypedCap False v0 v1 f) prev_cap; f < 2147483648; is_aligned (word_of_nat f) 4; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = SCAST(32 signed \<rightarrow> 32) false, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f \<noteq> 0; 0 < f; resetChunkBits \<le> v1; word_of_nat f \<le> 2 ^ v1; v0 \<le> v0 + word_of_nat f - 1; Suc n \<le> unat ((word_of_nat f - 1) div 2 ^ resetChunkBits); cteCap cte = capability.UntypedCap False v0 v1 f; \<not> d; 2 ^ resetChunkBits \<le> gsMaxObjectSize s; invs' s; ctes_of s slot = Some ctea; descendants_of' slot (ctes_of s) = {}; pspace_no_overlap' v0 v1 s; cteCap ctea = capability.UntypedCap False v0 v1 idx'; 2 ^ resetChunkBits * ((word_of_nat f - 1) div 2 ^ resetChunkBits) = (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits; is_aligned v0 v1; valid_untyped' False v0 v1 idx' s; v1 < word_bits; idx' \<le> 2 ^ v1; is_aligned (word_of_nat idx') 4; valid_untyped' False v0 v1 f x; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits \<le> (word_of_nat idx' - 1 && ~~ mask resetChunkBits) + word_of_nat n * 2 ^ resetChunkBits
 2. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 5. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 7. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 8. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 9. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (9 subgoals):
 1. \<And>cte prev_cap rv' rv'a t t'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'7119 cte prev_cap rv' rv'a)
 2. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (?d'7119 cte prev_cap rv' rv'a)
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 4. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 6. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 7. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 8. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (8 subgoals):
 1. \<And>cte prev_cap rv' rv rv'a. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7119 cte prev_cap rv' rv) (?Q'7119 cte prev_cap rv' rv rv'a) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>?Q7119 cte prev_cap rv'\<rbrace>, -
 3. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'7119 cte prev_cap rv' (theRight v))
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 5. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 6. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 7. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (7 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R7123 cte prev_cap ()\<rbrace> mapME_x (\<lambda>addr. do y <- doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits));
y <- updateFreeIndex slot (getFreeIndex (capPtr (cteCap cte)) addr);
preemptionPoint
od) (rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1]) \<lbrace>\<lambda>a b. True\<rbrace>, -
 2. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc (theRight v) (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>)
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and ?R7123 cte prev_cap a and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 4. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 5. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 6. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (6 subgoals):
 1. \<And>cte prev_cap rv'. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2147483648; is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 4294967296; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte); resetChunkBits \<le> capBlockSize (cteCap cte); word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc (theRight v) (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>)
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and (\<lambda>a. True) and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 3. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 4. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 5. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (5 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capIsDevice (cteCap cte) \<longrightarrow> ((\<lambda>s. invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) \<le> resetChunkBits)) s) and (\<lambda>s. \<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> True) and (\<lambda>a. (\<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True) \<and> (\<not> \<not> capIsDevice (cteCap cte) \<longrightarrow> valid_objs' a \<and> cte_wp_at' (\<lambda>ctea. isUntypedCap (cteCap ctea) \<and> cteCap cte = cteCap ctea) slot a \<and> untyped_ranges_zero' a \<and> (is_aligned (word_of_nat 0) 4 \<and> 0 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> True))) s) and (\<lambda>s. \<not> (capIsDevice (cteCap cte) \<or> capBlockSize (cteCap cte) < resetChunkBits) \<longrightarrow> ((\<lambda>s. 2 ^ resetChunkBits \<le> gsMaxObjectSize s) and (cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot and invs' and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) and (\<lambda>_. (\<exists>s. valid_cap' (cteCap cte) s) \<and> \<not> capIsDevice (cteCap cte)) and (\<lambda>_. capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1) and (\<lambda>a. True) and (\<lambda>_. resetChunkBits \<le> capBlockSize (cteCap cte) \<and> word_of_nat (capFreeIndex (cteCap cte)) - 1 < 2 ^ capBlockSize (cteCap cte))) s)\<rbrace>
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 3. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 4. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (5 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>a b. (capIsDevice (cteCap cte) \<longrightarrow> valid_objs' b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot b \<and> untyped_ranges_zero' b) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> invs' b \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot b \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) b) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize b \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> valid_objs' b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot b \<and> untyped_ranges_zero' b) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize b \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot b \<and> invs' b \<and> descendants_of' slot (ctes_of b) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) b \<and> Ex (valid_cap' (cteCap cte)) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte))\<rbrace>
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 3. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 4. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (5 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?R6374 (cte_Ptr slot) cte\<rbrace> deleteObjects (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<lbrace>\<lambda>r s. (capIsDevice (cteCap cte) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot s \<and> invs' s) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> invs' s \<and> (\<exists>cap. cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s \<and> isUntypedCap cap \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange cap \<and> pspace_no_overlap' (capPtr cap) (capBlockSize cap) s) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> invs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot s \<and> invs' s) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> cte_wp_at' (\<lambda>cte'. \<exists>idx'. cteCap cte' = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot s \<and> invs' s \<and> descendants_of' slot (ctes_of s) = {} \<and> pspace_no_overlap' (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) s \<and> Ex (valid_cap' (cteCap cte)) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte))\<rbrace>
 2. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 3. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 4. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 (cte_Ptr slot) cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and ?R6374 srcSlot cte) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> {s. bits_'_update (\<lambda>_. word_of_nat (capBlockSize (cteCap cte))) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) (capPtr (cteCap cte))\<rparr>) \<in> {s. region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> \<lbrace>\<acute>bits = word_of_nat (capBlockSize (cteCap cte))\<rbrace> \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPtr (cteCap cte))\<rbrace>}) \<and> (s \<notin> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < SCAST(32 signed \<rightarrow> 32) 0x20 \<longrightarrow> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<noteq> 0 \<and> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) \<le> ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte)))) + ((1 << unat (word_of_nat (capBlockSize (cteCap cte)))) - 1) \<and> is_aligned (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) 2 \<and> is_aligned (1 << unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))..+unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {1 << unat (word_of_nat (capBlockSize (cteCap cte)))..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) (replicate (unat (1 << unat (word_of_nat (capBlockSize (cteCap cte))))) (UCAST(?'a6749 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = addrFromPPtr (ptr_val (PTR_COERCE(32 word \<rightarrow> unit) (PTR(32 word) (capPtr (cteCap cte))))) \<longrightarrow> (\<forall>ta. hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<and> byte_regions_unmodified (t_hrs_' (globals t)) (t_hrs_' (globals ta)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) t \<and> heap_list (hrs_mem (t_hrs_' (globals ta))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)))) \<and> (from_bool (capIsDevice (cteCap cte)) \<noteq> 0 \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0)} \<inter> \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace> \<union> {s. s\<lparr>offset___unsigned_long_' := word_of_nat (capFreeIndex (cteCap cte)) - 1 && ~~ mask 8\<rparr> \<in> {s. \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s} \<inter> UNIV \<inter> UNIV \<inter> UNIV} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8\<rbrace>}
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 (cte_Ptr slot) cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 srcSlot cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (4 subgoals):
 1. \<And>cte prev_cap. \<lbrakk>ccap_relation (cteCap cte) prev_cap; isUntypedCap (cteCap cte); capFreeIndex (cteCap cte) < 2 ^ word_bits; capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0); is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4; capBlockSize (cteCap cte) < 2 ^ word_bits; cap_get_tag prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift prev_cap = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>); cap_untyped_cap_lift prev_cap = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cteCap cte)) >> 4, capIsDevice_CL = from_bool (capIsDevice (cteCap cte)), capBlockSize_CL = word_of_nat (capBlockSize (cteCap cte)), capPtr_CL = capPtr (cteCap cte)\<rparr>; word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0; 0 < capFreeIndex (cteCap cte)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F6369 cte prev_cap\<^esub> (?R'6370 cte prev_cap (word_of_nat (capBlockSize (cteCap cte))) (capPtr (cteCap cte)) (word_of_nat (capFreeIndex (cteCap cte)) >> 4) (from_bool (capIsDevice (cteCap cte)))) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) {s. (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s) \<and> (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 0x20 \<longrightarrow> capPtr (cteCap cte) \<noteq> 0 \<and> capPtr (cteCap cte) \<le> capPtr (cteCap cte) + (2 ^ unat (word_of_nat (capBlockSize (cteCap cte))) - 1) \<and> is_aligned (capPtr (cteCap cte)) 2 \<and> is_aligned (2 ^ unat (word_of_nat (capBlockSize (cteCap cte)))) 2 \<and> {capPtr (cteCap cte)..+unat (2 ^ unat (word_of_nat (capBlockSize (cteCap cte))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat (word_of_nat (capBlockSize (cteCap cte))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr (cteCap cte)) (replicate (unat (2 ^ unat (word_of_nat (capBlockSize (cteCap cte))))) 0)) (t_hrs_' (globals s))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr (cteCap cte))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr (cteCap cte)) (replicate (unat (2 ^ unat (word_of_nat (capBlockSize (cteCap cte))))) 0)) (t_hrs_' (globals s))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) s \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cteCap cte)) (capPtr (cteCap cte)) = replicate (capFreeIndex (cteCap cte)) 0))) \<and> (from_bool (capIsDevice (cteCap cte)) = 0 \<longrightarrow> word_of_nat (capBlockSize (cteCap cte)) < 8) \<or> (\<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes (capPtr (cteCap cte)) (2 ^ capBlockSize (cteCap cte)) s) \<and> from_bool (capIsDevice (cteCap cte)) = 0 \<and> \<not> word_of_nat (capBlockSize (cteCap cte)) < 8}
 2. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vc. status_'_update (\<lambda>_. vc) sa \<in> {sa. \<forall>vc v'. vc = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vc\<rparr> \<in> {sa. sa \<in> {sa. deviceMemory_'_update (\<lambda>_. vc) sa \<in> {sa. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> sa \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'6370 cte (prev_cap_' s) v va vb vc)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 3. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 (cte_Ptr slot) cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 srcSlot cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (3 subgoals):
 1. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s. s \<in> {sa. \<forall>v v'. v = capBlockSize_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. block_size_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. regionBase_'_update (\<lambda>_. PTR(unit) va) sa \<in> {sa. chunk_'_update (\<lambda>_. 8) sa \<in> {sa. \<forall>vb v'. vb = capFreeIndex_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>offset___unsigned_long_' := vb << 4\<rparr> \<in> {sa. \<forall>vb. status_'_update (\<lambda>_. vb) sa \<in> {sa. \<forall>vb v'. vb = capIsDevice_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. deviceMemory_'_update (\<lambda>_. vb) s \<in> {s. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> s \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes va (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (vb = 0 \<longrightarrow> region_actually_is_bytes' va (2 ^ capBlockSize (cteCap cte)) (hrs_htd (hrs_htd_update (typ_region_bytes va (capBlockSize (cteCap cte))) \<acute>t_hrs))) \<and> (vb = 0 \<longrightarrow> v < 0x20 \<longrightarrow> va \<noteq> 0 \<and> va \<le> va + (2 ^ unat v - 1) \<and> is_aligned va 2 \<and> is_aligned (2 ^ unat v) 2 \<and> {va..+unat (2 ^ unat v)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes va (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region va (capBlockSize (cteCap cte)) \<acute>ghost'state) = 0 \<or> 2 ^ unat v \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region va (capBlockSize (cteCap cte)) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list va (replicate (unat (2 ^ unat v)) 0)) (hrs_htd_update (typ_region_bytes va (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr va) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes va (capBlockSize (cteCap cte))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list va (replicate (unat (2 ^ unat v)) 0)) (hrs_htd_update (typ_region_bytes va (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes' va (capFreeIndex (cteCap cte)) (hrs_htd (hrs_htd_update (typ_region_bytes va (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap cte)) va = replicate (capFreeIndex (cteCap cte)) 0))) \<and> (vb = 0 \<longrightarrow> v < 8) \<or> (\<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes' va (2 ^ capBlockSize (cteCap cte)) (hrs_htd (hrs_htd_update (typ_region_bytes va (capBlockSize (cteCap cte))) \<acute>t_hrs))) \<and> vb = 0 \<and> \<not> v < 8\<rbrace>)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. prev_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>ccap_relation (cteCap cte) \<^bsup>s\<^esup>prev_cap\<rbrace>}
 2. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 (cte_Ptr slot) cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 srcSlot cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (3 subgoals):
 1. \<And>cte. \<Gamma>\<turnstile> (?C'1555 cte) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<lbrace>(word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift \<acute>prev_cap) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (2 ^ capBlockSize (cteCap cte)) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift \<acute>prev_cap) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift \<acute>prev_cap) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap) \<le> capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift \<acute>prev_cap)) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift \<acute>prev_cap))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift \<acute>prev_cap)))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte)) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift \<acute>prev_cap)) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte)) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift \<acute>prev_cap)))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift \<acute>prev_cap)))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capFreeIndex (cteCap cte)) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap cte)) (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) = replicate (capFreeIndex (cteCap cte)) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift \<acute>prev_cap) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift \<acute>prev_cap) < 8) \<or> (\<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (2 ^ capBlockSize (cteCap cte)) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift \<acute>prev_cap)) (capBlockSize (cteCap cte))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift \<acute>prev_cap) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift \<acute>prev_cap) < 8) \<and> cap_get_tag \<acute>prev_cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap cte) \<acute>prev_cap\<rbrace>
 2. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 (cte_Ptr slot) cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (?C'1555 cte \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 srcSlot cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?C'1557 srcSlot cte' \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot)
?C'1557 (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>cte'. ?C'1555 (cte_to_H cte') proof (prove)
goal (2 subgoals):
 1. \<And>cte s. ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 (cte_Ptr slot) cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 (cte_Ptr slot) cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 (cte_Ptr slot) cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits)) s \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>(word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte)) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap cte)) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte)) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte)) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap cte)) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap cte)) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap cte)) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap cte) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap cte)) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap cte))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap cte) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>prev_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) {s'. (s, s') \<in> rf_sr}
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 srcSlot cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot) proof (prove)
goal (1 subgoal):
 1. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 srcSlot cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot) proof (prove)
goal (2 subgoals):
 1. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>a. (word_of_nat (capFreeIndex (cteCap cte)) = 0 \<longrightarrow> True) \<and> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot and (\<lambda>s. descendants_range' (capability.UntypedCap (?d6386 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits) and (\<lambda>a. (capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8846 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8867 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d8905 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> ((cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a) \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize a \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9005 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9026 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize a \<and> (cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot a \<and> slot \<notin> {capPtr (cteCap cte)..capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1} \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9061 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 srcSlot cte)) slot (ctes_of s)) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 srcSlot cte)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d9079 srcSlot cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 srcSlot cte)) slot (ctes_of s)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)))) a \<and> (valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) and valid_pspace') a \<and> (\<exists>a. valid_cap' (cteCap cte) a) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte)))) a)) and (\<lambda>_. isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - 1) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) minUntypedSizeBits \<and> capBlockSize (cteCap cte) < 2 ^ word_bits) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; cte_wp_at' (isUntypedCap \<circ> cteCap) slot s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot s \<and> descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits \<and> (capIsDevice (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d8846 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot s \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d8867 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d8905 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot s \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d9005 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot s \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d9026 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot s \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d9061 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d9079 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> Ex (valid_cap' (cteCap cte)) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte))) \<and> isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4 \<and> capBlockSize (cteCap cte) < 2 ^ word_bits \<and> cte_wp_at' (\<lambda>_. True) slot s
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; cte_wp_at' (isUntypedCap \<circ> cteCap) slot s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>ctea. cteCap ctea = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot s \<and> descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits \<and> (capIsDevice (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8849 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d8846 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot s \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8870 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d8867 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d8908 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d8905 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) slot s \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> isUntypedCap (cteCap cte) \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9008 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d9005 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> cteCap cte = cteCap a) slot s \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9029 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d9026 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> cte_wp_at' (\<lambda>a. \<exists>idx'. cteCap a = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) slot s \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9064 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d9061 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d9082 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 (cte_Ptr slot) cte)) slot s \<and> descendants_range' (capability.UntypedCap (?d9079 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> Ex (valid_cap' (cteCap cte)) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte))) \<and> isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4 \<and> capBlockSize (cteCap cte) < 2 ^ word_bits \<and> cte_wp_at' (\<lambda>_. True) slot s
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; isUntypedCap (cteCap cte); descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> cteCap cte = capability.UntypedCap (?d6388 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte)) \<and> descendants_range' (capability.UntypedCap (?d6386 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits \<and> (capIsDevice (cteCap cte) \<longrightarrow> cteCap cte = capability.UntypedCap (?d8849 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8848 (cte_Ptr slot) cte) \<and> descendants_range' (capability.UntypedCap (?d8846 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8844 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> cteCap cte = capability.UntypedCap (?d8870 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8869 (cte_Ptr slot) cte) \<and> descendants_range' (capability.UntypedCap (?d8867 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8865 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> cteCap cte = capability.UntypedCap (?d8908 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8907 (cte_Ptr slot) cte) \<and> descendants_range' (capability.UntypedCap (?d8905 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx8903 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> cteCap cte = capability.UntypedCap (?d9008 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9007 (cte_Ptr slot) cte) \<and> descendants_range' (capability.UntypedCap (?d9005 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9003 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> cteCap cte = capability.UntypedCap (?d9029 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9028 (cte_Ptr slot) cte) \<and> descendants_range' (capability.UntypedCap (?d9026 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9024 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> (\<exists>idx'. cteCap cte = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> cteCap cte = capability.UntypedCap (?d9064 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9063 (cte_Ptr slot) cte) \<and> descendants_range' (capability.UntypedCap (?d9061 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9059 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> cteCap cte = capability.UntypedCap (?d9082 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9081 (cte_Ptr slot) cte) \<and> descendants_range' (capability.UntypedCap (?d9079 (cte_Ptr slot) cte) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (?idx9077 (cte_Ptr slot) cte)) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> Ex (valid_cap' (cteCap cte)) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte))) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4 \<and> capBlockSize (cteCap cte) < 2 ^ word_bits
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>}
flex-flex pairs:
?d9082 (cte_Ptr slot) \<equiv>\<^sup>? ?d9079 (cte_Ptr slot)
?idx9081 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9077 (cte_Ptr slot)
?d9064 (cte_Ptr slot) \<equiv>\<^sup>? ?d9061 (cte_Ptr slot)
?idx9063 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9059 (cte_Ptr slot)
?d9029 (cte_Ptr slot) \<equiv>\<^sup>? ?d9026 (cte_Ptr slot)
?idx9028 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9024 (cte_Ptr slot)
?d9008 (cte_Ptr slot) \<equiv>\<^sup>? ?d9005 (cte_Ptr slot)
?idx9007 (cte_Ptr slot) \<equiv>\<^sup>? ?idx9003 (cte_Ptr slot)
?d8908 (cte_Ptr slot) \<equiv>\<^sup>? ?d8905 (cte_Ptr slot)
?idx8907 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8903 (cte_Ptr slot)
?d8870 (cte_Ptr slot) \<equiv>\<^sup>? ?d8867 (cte_Ptr slot)
?idx8869 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8865 (cte_Ptr slot)
?d8849 (cte_Ptr slot) \<equiv>\<^sup>? ?d8846 (cte_Ptr slot)
?idx8848 (cte_Ptr slot) \<equiv>\<^sup>? ?idx8844 (cte_Ptr slot)
?d6388 (cte_Ptr slot) \<equiv>\<^sup>? ?d6386 (cte_Ptr slot) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; isUntypedCap (cteCap cte); descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> descendants_range' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits \<and> (capIsDevice (cteCap cte) \<longrightarrow> descendants_range' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> descendants_range' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> descendants_range' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> descendants_range' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> descendants_range' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> (\<exists>idx'. cteCap cte = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> descendants_range' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> descendants_range' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> Ex (valid_cap' (cteCap cte)) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte))) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4 \<and> capBlockSize (cteCap cte) < 2 ^ word_bits
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; isUntypedCap (cteCap cte); descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> descendants_range' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits \<and> (capIsDevice (cteCap cte) \<longrightarrow> descendants_range' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> descendants_range' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> descendants_range' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> descendants_range' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> descendants_range' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> (\<exists>idx'. cteCap cte = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> descendants_range' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> descendants_range' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> Ex (valid_cap' (cteCap cte)) \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte))) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4 \<and> capBlockSize (cteCap cte) < 2 ^ word_bits
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; isUntypedCap (cteCap cte); descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cteCap cte)) \<noteq> 0 \<longrightarrow> descendants_range' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> 2 \<le> capBlockSize (cteCap cte) \<and> capBlockSize (cteCap cte) < word_bits \<and> (capIsDevice (cteCap cte) \<longrightarrow> descendants_range' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> descendants_range' (capability.UntypedCap True (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> (\<not> capIsDevice (cteCap cte) \<longrightarrow> descendants_range' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> {capPtr (cteCap cte)..+2 ^ capBlockSize (cteCap cte)} \<subseteq> untypedRange (cteCap cte) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> 2 ^ capBlockSize (cteCap cte) \<le> gsMaxObjectSize s \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> 2 \<le> capBlockSize (cteCap cte)) \<and> descendants_range' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> descendants_range' (capability.UntypedCap (capIsDevice (cteCap cte)) (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte))) \<and> (\<not> capIsDevice (cteCap cte) \<and> \<not> capBlockSize (cteCap cte) < resetChunkBits \<longrightarrow> 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> (\<exists>idx'. cteCap cte = capFreeIndex_update (\<lambda>_. idx') (cteCap cte) \<and> rev [capPtr (cteCap cte) , capPtr (cteCap cte) + 2 ^ resetChunkBits .e. getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1] ! 0 = getFreeRef (capPtr (cteCap cte)) idx' - 1 && ~~ mask resetChunkBits) \<and> (capPtr (cteCap cte) \<le> slot \<longrightarrow> \<not> slot \<le> capPtr (cteCap cte) + 2 ^ capBlockSize (cteCap cte) - 1) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> descendants_range' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> descendants_range' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) slot (ctes_of s) \<and> capBlockSize (cteCap cte) < word_bits \<and> is_aligned (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) \<and> valid_cap' (capability.UntypedCap False (capPtr (cteCap cte)) (capBlockSize (cteCap cte)) (capFreeIndex (cteCap cte))) s \<and> valid_pspace' s \<and> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1 \<and> word_of_nat (capFreeIndex (cteCap cte)) \<le> 2 ^ capBlockSize (cteCap cte))) \<and> capFreeIndex (cteCap cte) < 2 ^ word_bits \<and> capFreeIndex (cteCap cte) < 2 ^ (word_bits - Suc 0) \<and> is_aligned (word_of_nat (capFreeIndex (cteCap cte))) 4 \<and> capBlockSize (cteCap cte) < 2 ^ word_bits
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v1 < word_bits; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29\<rbrakk> \<Longrightarrow> v1 < 2 ^ word_bits \<and> f < 2 ^ word_bits \<and> f < 2 ^ (word_bits - Suc 0) \<and> (word_of_nat f \<noteq> 0 \<longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1)) \<and> (v1 < resetChunkBits \<longrightarrow> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> (\<not> d \<longrightarrow> valid_untyped' False v0 v1 f s \<and> 2 ^ v1 \<le> gsMaxObjectSize s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1))) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> v0 \<le> v0 + word_of_nat f - 1 \<and> word_of_nat f \<le> 2 ^ v1 \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. v0 + word_of_nat f - 1] ! 0 = v0 + word_of_nat f - 1 && ~~ mask resetChunkBits))
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v1 < word_bits; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> v1 < 2 ^ word_bits \<and> f < 2 ^ word_bits \<and> f < 2 ^ (word_bits - Suc 0) \<and> (word_of_nat f \<noteq> 0 \<longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1)) \<and> (v1 < resetChunkBits \<longrightarrow> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> (\<not> d \<longrightarrow> valid_untyped' False v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1))) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> 2 ^ resetChunkBits \<le> gsMaxObjectSize s \<and> v0 \<le> v0 + word_of_nat f - 1 \<and> word_of_nat f \<le> 2 ^ v1 \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. v0 + word_of_nat f - 1] ! 0 = v0 + word_of_nat f - 1 && ~~ mask resetChunkBits))
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v1 < word_bits; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> 29 < 2 ^ word_bits \<and> 2 ^ v1 < 2 ^ word_bits \<and> 2 ^ v1 < 2 ^ (word_bits - Suc 0) \<and> (word_of_nat f \<noteq> 0 \<longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1)) \<and> (v1 < resetChunkBits \<longrightarrow> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> (\<not> d \<longrightarrow> valid_untyped' False v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1))) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> 2 ^ resetChunkBits \<le> 2 ^ v1 \<and> v0 \<le> v0 + word_of_nat f - 1 \<and> word_of_nat f \<le> 2 ^ v1 \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. v0 + word_of_nat f - 1] ! 0 = v0 + word_of_nat f - 1 && ~~ mask resetChunkBits))
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v1 < word_bits; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> 29 < 2 ^ word_bits \<and> v1 < word_bits - Suc 0 \<and> (word_of_nat f \<noteq> 0 \<longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1)) \<and> (v1 < resetChunkBits \<longrightarrow> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> (\<not> d \<longrightarrow> valid_untyped' False v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1))) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> v0 \<le> v0 + word_of_nat f - 1 \<and> word_of_nat f \<le> 2 ^ v1 \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. v0 + word_of_nat f - 1] ! 0 = v0 + word_of_nat f - 1 && ~~ mask resetChunkBits))
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1)) \<and> (v1 < resetChunkBits \<longrightarrow> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> (\<not> d \<longrightarrow> valid_untyped' False v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1))) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> v0 \<le> v0 + word_of_nat f - 1 \<and> word_of_nat f \<le> 2 ^ v1 \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. v0 + word_of_nat f - 1] ! 0 = v0 + word_of_nat f - 1 && ~~ mask resetChunkBits)
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0; capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1\<rbrakk> \<Longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1)) \<and> (v1 < resetChunkBits \<longrightarrow> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> (\<not> d \<longrightarrow> valid_untyped' False v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1))) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> v0 \<le> v0 + word_of_nat f - 1 \<and> word_of_nat f \<le> 2 ^ v1 \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. v0 + word_of_nat f - 1] ! 0 = v0 + word_of_nat f - 1 && ~~ mask resetChunkBits)
 2. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1
 3. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>s s' cte d v0 v1 f x1 x2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (CTE (capability.UntypedCap d v0 v1 f) x2); ex_cte_cap_wp_to' (\<lambda>_. True) slot s; x1 = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0; v0 \<le> getFreeRef v0 f - 1; cte = CTE (capability.UntypedCap d v0 v1 f) x2\<rbrakk> \<Longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1)) \<and> (v1 < resetChunkBits \<longrightarrow> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> (\<not> d \<longrightarrow> valid_untyped' False v0 v1 f s \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1))) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> v0 \<le> v0 + word_of_nat f - 1 \<and> word_of_nat f \<le> 2 ^ v1 \<and> (v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1) \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. v0 + word_of_nat f - 1] ! 0 = v0 + word_of_nat f - 1 && ~~ mask resetChunkBits)
 2. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1
 3. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>s s' d v0 v1 f x2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (CTE (capability.UntypedCap d v0 v1 f) x2); ex_cte_cap_wp_to' (\<lambda>_. True) slot s; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0; v0 \<le> getFreeRef v0 f - 1; v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1\<rbrakk> \<Longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s) \<and> (v1 < resetChunkBits \<longrightarrow> \<not> d \<longrightarrow> valid_untyped' False v0 v1 f s) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> v0 \<le> v0 + word_of_nat f - 1 \<and> word_of_nat f \<le> 2 ^ v1 \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. v0 + word_of_nat f - 1] ! 0 = v0 + word_of_nat f - 1 && ~~ mask resetChunkBits)
 2. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1
 3. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>s s' d v0 v1 f x2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (CTE (capability.UntypedCap d v0 v1 f) x2); ex_cte_cap_wp_to' (\<lambda>_. True) slot s; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0; v0 \<le> getFreeRef v0 f - 1; v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1\<rbrakk> \<Longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s) \<and> (v1 < resetChunkBits \<longrightarrow> \<not> d \<longrightarrow> valid_untyped' False v0 v1 f s) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> word_of_nat f - 1 < 2 ^ v1 \<and> word_of_nat f \<le> 2 ^ v1 \<and> rev [v0 , v0 + 2 ^ resetChunkBits .e. v0 + word_of_nat f - 1] ! 0 = v0 + word_of_nat f - 1 && ~~ mask resetChunkBits)
 2. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1
 3. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>s s' d v0 v1 f x2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (CTE (capability.UntypedCap d v0 v1 f) x2); ex_cte_cap_wp_to' (\<lambda>_. True) slot s; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0; v0 \<le> v0 + word_of_nat f - 1; v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1\<rbrakk> \<Longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s) \<and> (v1 < resetChunkBits \<longrightarrow> \<not> d \<longrightarrow> valid_untyped' False v0 v1 f s) \<and> (\<not> d \<and> \<not> v1 < resetChunkBits \<longrightarrow> valid_untyped' False v0 v1 f s \<and> (word_of_nat f - 1) div 2 ^ resetChunkBits * 2 ^ resetChunkBits = word_of_nat f - 1 && ~~ mask resetChunkBits)
 2. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1
 3. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (3 subgoals):
 1. \<And>s s' d v0 v1 f x2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (CTE (capability.UntypedCap d v0 v1 f) x2); ex_cte_cap_wp_to' (\<lambda>_. True) slot s; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0; v0 \<le> v0 + word_of_nat f - 1; v0 \<le> slot \<longrightarrow> \<not> slot \<le> v0 + 2 ^ v1 - 1\<rbrakk> \<Longrightarrow> (d \<longrightarrow> valid_untyped' True v0 v1 f s) \<and> (v1 < 8 \<longrightarrow> \<not> d \<longrightarrow> valid_untyped' False v0 v1 f s) \<and> (\<not> d \<and> \<not> v1 < 8 \<longrightarrow> valid_untyped' False v0 v1 f s)
 2. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1
 3. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> capPtr (cteCap cte) \<le> getFreeRef (capPtr (cteCap cte)) (capFreeIndex (cteCap cte)) - 1
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> v0 \<le> v0 + word_of_nat f - 1
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; ex_cte_cap_wp_to' (\<lambda>_. True) slot s; cteCap cte = capability.UntypedCap d v0 v1 f; is_aligned v0 v1; v0 \<noteq> 0; valid_untyped' d v0 v1 f s; 4 \<le> v1; is_aligned (word_of_nat f) 4; f \<le> 2 ^ v1; v1 \<le> 29; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; word_of_nat f \<noteq> 0\<rbrakk> \<Longrightarrow> word_of_nat f - 1 < 2 ^ v1
 2. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (1 subgoal):
 1. \<And>srcSlot s s'. \<lbrakk>srcSlot = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) slot and (\<lambda>s. descendants_of' slot (ctes_of s) = {})) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) srcSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>(word_of_nat (capFreeIndex (cteCap (cte_to_H cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd \<acute>t_hrs)) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte'))) \<acute>ghost'state)) \<and> ((\<exists>t. \<^bsup>t\<^esup>t_hrs = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd \<^bsup>t\<^esup>t_hrs = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<^bsup>t\<^esup>t_hrs \<longrightarrow> \<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs)) \<and> heap_list (hrs_mem \<^bsup>t\<^esup>t_hrs) (capFreeIndex (cteCap (cte_to_H cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cteCap (cte_to_H cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cteCap (cte_to_H cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cteCap (cte_to_H cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))) (capBlockSize (cteCap (cte_to_H cte')))) \<acute>t_hrs))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cteCap (cte_to_H cte')) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>} proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some cte; isUntypedCap (cteCap cte); (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr slot) = Some cte'; cl_valid_cte cte'\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cap_to_H (cap_CL cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cap_to_H (cap_CL cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cap_to_H (cap_CL cte')) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); isUntypedCap (cap_to_H (cap_CL cte')); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cap_to_H (cap_CL cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cap_to_H (cap_CL cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cap_to_H (cap_CL cte')) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); isUntypedCap (cap_to_H (cap_CL cte')); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccte_relation (cte_to_H cte') cte'a\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<le> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capFreeIndex (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cap_to_H (cap_CL cte'))) (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) = replicate (capFreeIndex (cap_to_H (cap_CL cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 8) \<or> (\<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (2 ^ capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))))) \<and> capIsDevice_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 8) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ccap_relation (cap_to_H (cap_CL cte')) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); isUntypedCap (cap_to_H (cap_CL cte')); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (cap_to_H (cap_CL cte')) (cte_C.cap_C cte'a)\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (2 ^ capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<le> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capFreeIndex (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cap_to_H (cap_CL cte'))) (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) = replicate (capFreeIndex (cap_to_H (cap_CL cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) \<or> (\<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (2 ^ capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))))) \<and> capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) \<and> cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); isUntypedCap (cap_to_H (cap_CL cte')); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (cap_to_H (cap_CL cte')) (cte_C.cap_C cte'a)\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> (\<exists>htd'. hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))) = typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) htd')) \<and> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<le> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capFreeIndex (cap_to_H (cap_CL cte'))) (hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cap_to_H (cap_CL cte'))) (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) = replicate (capFreeIndex (cap_to_H (cap_CL cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) \<or> (\<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> (\<exists>htd'. hrs_htd (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s'))) = typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) htd')) \<and> capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) \<and> cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); isUntypedCap (cap_to_H (cap_CL cte')); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (cap_to_H (cap_CL cte')) (cte_C.cap_C cte'a)\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<le> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capFreeIndex (cap_to_H (cap_CL cte'))) (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cap_to_H (cap_CL cte'))) (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) = replicate (capFreeIndex (cap_to_H (cap_CL cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) \<or> capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) \<and> cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); isUntypedCap (cap_to_H (cap_CL cte')); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (cap_to_H (cap_CL cte')) (cte_C.cap_C cte'a); cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> cap_lift (cte_C.cap_C cte'a) = Some (Cap_untyped_cap (cap_untyped_cap_lift (cte_C.cap_C cte'a))) \<and> cap_untyped_cap_lift (cte_C.cap_C cte'a) = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) >> 4, capIsDevice_CL = from_bool (capIsDevice (cap_to_H (cap_CL cte'))), capBlockSize_CL = word_of_nat (capBlockSize (cap_to_H (cap_CL cte'))), capPtr_CL = capPtr (cap_to_H (cap_CL cte'))\<rparr>\<rbrakk> \<Longrightarrow> (word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) \<noteq> 0 \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<le> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capFreeIndex (cap_to_H (cap_CL cte'))) (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cap_to_H (cap_CL cte'))) (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) = replicate (capFreeIndex (cap_to_H (cap_CL cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) \<or> capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) \<and> cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); isUntypedCap (cap_to_H (cap_CL cte')); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (cap_to_H (cap_CL cte')) (cte_C.cap_C cte'a); valid_cap' (cteCap (cte_to_H cte')) s; cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift (cte_C.cap_C cte'a) = Some (Cap_untyped_cap (cap_untyped_cap_lift (cte_C.cap_C cte'a))); cap_untyped_cap_lift (cte_C.cap_C cte'a) = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) >> 4, capIsDevice_CL = from_bool (capIsDevice (cap_to_H (cap_CL cte'))), capBlockSize_CL = word_of_nat (capBlockSize (cap_to_H (cap_CL cte'))), capPtr_CL = capPtr (cap_to_H (cap_CL cte'))\<rparr>; word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) \<noteq> 0; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))); \<not> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8)\<rbrakk> \<Longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<le> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capFreeIndex (cap_to_H (cap_CL cte'))) (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cap_to_H (cap_CL cte'))) (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) = replicate (capFreeIndex (cap_to_H (cap_CL cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); isUntypedCap (cap_to_H (cap_CL cte')); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (cap_to_H (cap_CL cte')) (cte_C.cap_C cte'a); valid_cap' (cteCap (cte_to_H cte')) s; cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_lift (cte_C.cap_C cte'a) = Some (Cap_untyped_cap (cap_untyped_cap_lift (cte_C.cap_C cte'a))); cap_untyped_cap_lift (cte_C.cap_C cte'a) = \<lparr>capFreeIndex_CL = word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) >> 4, capIsDevice_CL = from_bool (capIsDevice (cap_to_H (cap_CL cte'))), capBlockSize_CL = word_of_nat (capBlockSize (cap_to_H (cap_CL cte'))), capPtr_CL = capPtr (cap_to_H (cap_CL cte'))\<rparr>; word_of_nat (capFreeIndex (cap_to_H (cap_CL cte'))) \<noteq> 0; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))); \<not> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<and> \<not> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8); kernel_data_refs \<inter> capRange (cteCap (cte_to_H cte')) = {} \<and> global_refs' s \<subseteq> kernel_data_refs \<and> 2 ^ capBits (cteCap (cte_to_H cte')) \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 0x20 \<longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<noteq> 0 \<and> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) \<le> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) + (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) - 1) \<and> is_aligned (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) 2 \<and> is_aligned (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) 2 \<and> {capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))..+unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)))) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (replicate (unat (2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))))) 0)) (hrs_htd_update (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte')))) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> \<not> capIsDevice (cap_to_H (cap_CL cte')) \<longrightarrow> region_actually_is_bytes' (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capFreeIndex (cap_to_H (cap_CL cte'))) (typ_region_bytes (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) (capBlockSize (cap_to_H (cap_CL cte'))) (hrs_htd (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) (capFreeIndex (cap_to_H (cap_CL cte'))) (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a))) = replicate (capFreeIndex (cap_to_H (cap_CL cte'))) 0))) \<and> (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) = 0 \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'a)) < 8) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (capability.UntypedCap d v0 v1 f) (cte_C.cap_C cte'a); cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_CL cte' = Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = from_bool d, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_untyped_cap_lift (cte_C.cap_C cte'a) = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = from_bool d, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f >> 4 << 4 \<noteq> 0; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))); d \<or> word_of_nat v1 < 8; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; is_aligned v0 v1; unat (word_of_nat v1) = v1; unat (word_of_nat f >> 4 << 4) = f; v1 < word_bits; valid_untyped' d v0 v1 f s; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned (word_of_nat f) 4\<rbrakk> \<Longrightarrow> (\<not> d \<longrightarrow> word_of_nat v1 < 0x20 \<longrightarrow> v0 \<le> v0 + (2 ^ v1 - 1) \<and> is_aligned v0 2 \<and> is_aligned (2 ^ v1) 2 \<and> {v0..+2 ^ v1} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region v0 v1 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ v1 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region v0 v1 (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list v0 (replicate (2 ^ v1) 0)) (hrs_htd_update (typ_region_bytes v0 v1) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr v0) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list v0 (replicate (2 ^ v1) 0)) (hrs_htd_update (typ_region_bytes v0 v1) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> region_actually_is_bytes' v0 f (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) f v0 = replicate f 0))) \<and> (\<not> d \<longrightarrow> word_of_nat v1 < 8) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (capability.UntypedCap d v0 v1 f) (cte_C.cap_C cte'a); cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_CL cte' = Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = from_bool d, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_untyped_cap_lift (cte_C.cap_C cte'a) = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = from_bool d, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f >> 4 << 4 \<noteq> 0; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))); d \<or> word_of_nat v1 < 8; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; is_aligned v0 v1; unat (word_of_nat v1) = v1; unat (word_of_nat f >> 4 << 4) = f; v1 < word_bits; valid_untyped' d v0 v1 f s; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned (word_of_nat f) 4; gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> word_of_nat (2 ^ v1) \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s'))\<rbrakk> \<Longrightarrow> (\<not> d \<longrightarrow> word_of_nat v1 < 0x20 \<longrightarrow> v0 \<le> v0 + (2 ^ v1 - 1) \<and> is_aligned v0 2 \<and> is_aligned (2 ^ v1) 2 \<and> {v0..+2 ^ v1} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region v0 v1 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ v1 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region v0 v1 (ghost'state_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list v0 (replicate (2 ^ v1) 0)) (hrs_htd_update (typ_region_bytes v0 v1) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr v0) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list v0 (replicate (2 ^ v1) 0)) (hrs_htd_update (typ_region_bytes v0 v1) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> region_actually_is_bytes' v0 f (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) f v0 = replicate f 0))) \<and> (\<not> d \<longrightarrow> word_of_nat v1 < 8) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (capability.UntypedCap d v0 v1 f) (cte_C.cap_C cte'a); cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_CL cte' = Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = from_bool d, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_untyped_cap_lift (cte_C.cap_C cte'a) = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = from_bool d, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f >> 4 << 4 \<noteq> 0; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))); d \<or> word_of_nat v1 < 8; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; is_aligned v0 v1; unat (word_of_nat v1) = v1; unat (word_of_nat f >> 4 << 4) = f; v1 < word_bits; valid_untyped' d v0 v1 f s; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned (word_of_nat f) 4; snd (snd (ghost'state_' (globals s'))) (word_of_int cap_get_capSizeBits_'proc) = 0 \<or> 2 ^ v1 \<le> snd (snd (ghost'state_' (globals s'))) (word_of_int cap_get_capSizeBits_'proc)\<rbrakk> \<Longrightarrow> (\<not> d \<longrightarrow> word_of_nat v1 < 0x20 \<longrightarrow> v0 \<le> v0 + (2 ^ v1 - 1) \<and> is_aligned v0 2 \<and> is_aligned (2 ^ v1) 2 \<and> {v0..+2 ^ v1} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list v0 (replicate (2 ^ v1) 0)) (hrs_htd_update (typ_region_bytes v0 v1) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr v0) \<longrightarrow> (\<forall>t. hrs_htd (t_hrs_' (globals t)) = typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s'))) \<and> byte_regions_unmodified (hrs_mem_update (heap_update_list v0 (replicate (2 ^ v1) 0)) (hrs_htd_update (typ_region_bytes v0 v1) (t_hrs_' (globals s')))) (t_hrs_' (globals t)) \<longrightarrow> region_actually_is_bytes' v0 f (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))) \<and> heap_list (hrs_mem (t_hrs_' (globals t))) f v0 = replicate f 0))) \<and> (\<not> d \<longrightarrow> word_of_nat v1 < 8) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte' cte'a d v0 v1 f. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ct_active' s; descendants_of' slot (ctes_of s) = {}; ctes_of s slot = Some (cte_to_H cte'); cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some cte'a; cte_lift cte'a = Some cte'; c_valid_cte cte'a; ccap_relation (capability.UntypedCap d v0 v1 f) (cte_C.cap_C cte'a); cap_get_tag (cte_C.cap_C cte'a) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; cap_CL cte' = Cap_untyped_cap \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = from_bool d, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; cap_untyped_cap_lift (cte_C.cap_C cte'a) = \<lparr>capFreeIndex_CL = word_of_nat f >> 4, capIsDevice_CL = from_bool d, capBlockSize_CL = word_of_nat v1, capPtr_CL = v0\<rparr>; word_of_nat f >> 4 << 4 \<noteq> 0; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s')))); d \<or> word_of_nat v1 < 8; kernel_data_refs \<inter> {v0..v0 + 2 ^ v1 - 1} = {}; global_refs' s \<subseteq> kernel_data_refs; 2 ^ v1 \<le> gsMaxObjectSize s; is_aligned v0 v1; unat (word_of_nat f >> 4 << 4) = f; v1 < word_bits; valid_untyped' d v0 v1 f s; v0 \<noteq> 0; 4 \<le> v1; v1 \<le> 29; f \<le> 2 ^ v1; is_aligned (word_of_nat f) 4; snd (snd (ghost'state_' (globals s'))) (word_of_int cap_get_capSizeBits_'proc) = 0 \<or> 2 ^ v1 \<le> snd (snd (ghost'state_' (globals s'))) (word_of_int cap_get_capSizeBits_'proc)\<rbrakk> \<Longrightarrow> (\<not> d \<longrightarrow> word_of_nat v1 < 0x20 \<longrightarrow> is_aligned v0 2 \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list v0 (replicate (2 ^ v1) 0)) (hrs_htd_update (typ_region_bytes v0 v1) (t_hrs_' (globals s')))) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = addrFromPPtr v0) \<longrightarrow> (\<forall>x. hrs_htd (t_hrs_' (globals x)) = typ_region_bytes v0 v1 (hrs_htd (t_hrs_' (globals s'))) \<longrightarrow> byte_regions_unmodified (hrs_mem_update (heap_update_list v0 (replicate (2 ^ v1) 0)) (hrs_htd_update (typ_region_bytes v0 v1) (t_hrs_' (globals s')))) (t_hrs_' (globals x)) \<longrightarrow> 2 ^ v1 \<le> addr_card))) \<and> (\<not> d \<longrightarrow> word_of_nat v1 < 8) proof (prove)
goal:
No subgoals!