theory Untyped_R

lemma invokeUntyped_invs'':
 assumes insertNew_Q[wp]: "\<And>p cref cap.
    \<lbrace>Q\<rbrace> insertNewCap p cref cap \<lbrace>\<lambda>_. Q\<rbrace>"
 assumes createNew_Q: "\<And>tp ptr n us sz dev. \<lbrace>\<lambda>s. Q s
     \<and> range_cover ptr sz (APIType_capBits tp us) n
     \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us)
     \<and> 0 < n \<and> valid_pspace' s \<and> pspace_no_overlap' ptr sz s\<rbrace>
    createNewCaps tp ptr n us dev \<lbrace>\<lambda>_. Q\<rbrace>"
 assumes set_free_Q[wp]: "\<And>slot idx. \<lbrace>invs' and Q\<rbrace> updateFreeIndex slot idx \<lbrace>\<lambda>_.Q\<rbrace>"
 assumes reset_Q: "\<lbrace>Q'\<rbrace> resetUntypedCap (case ui of Invocations_H.Retype src_slot _ _ _ _ _ _ _ \<Rightarrow> src_slot) \<lbrace>\<lambda>_. Q\<rbrace>"
 shows "\<lbrace>invs' and valid_untyped_inv' ui
          and (\<lambda>s. (case ui of Invocations_H.Retype _ reset _ _ _ _ _ _ \<Rightarrow> reset) \<longrightarrow> Q' s)
          and Q and ct_active'\<rbrace>
     invokeUntyped ui
   \<lbrace>\<lambda>rv. invs' and Q\<rbrace>" apply (rule hoare_name_pre_state) apply (clarsimp simp only: pred_conj_def valid_untyped_inv_wcap') proof - fix s sz idx assume vui1: "valid_untyped_inv_wcap' ui
        (Some (case ui of
                Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow>
                  capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s" assume misc: "invs' s" "Q s" "ct_active' s"
        "(case ui of
         Invocations_H.untyped_invocation.Retype x reset _ _ _ _ _ _ \<Rightarrow> reset) \<longrightarrow>
        Q' s" obtain cref reset ptr tp us slots dev
      where pf: "invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz idx dev"
      and ui: "ui = Invocations_H.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev" using vui1 misc apply (cases ui, simp only: Invocations_H.untyped_invocation.simps) apply (frule(2) invokeUntyped_proofs.intro) apply clarsimp apply (unfold cte_wp_at_ctes_of) apply (drule meta_mp; clarsimp) done note vui = vui1[simplified ui Invocations_H.untyped_invocation.simps] have cover: "range_cover ptr sz (APIType_capBits tp us) (length slots)"
      and slots: "cref \<notin> set slots" "distinct slots" "slots \<noteq> []"
      and tps: "tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us"
            "tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits" using vui by (clarsimp simp: ui cte_wp_at_ctes_of)+ note not_0_ptr[simp] = invokeUntyped_proofs.not_0_ptr [OF pf] note subset_stuff[simp] = invokeUntyped_proofs.subset_stuff[OF pf] have non_detype_idx_le[simp]: "~ reset \<Longrightarrow> idx < 2^sz" using vui ui apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule le_less_trans) apply (rule unat_less_helper) apply simp apply (rule le_less_trans) apply (rule word_and_le1) apply (simp add:mask_def) apply (rule word_leq_le_minus_one) apply simp apply (clarsimp simp:range_cover_def) done note blah[simp del] = untyped_range.simps usable_untyped_range.simps atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff
          Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex usableUntypedRange.simps note descendants_range[simp] = invokeUntyped_proofs.descendants_range[OF pf] note ps_no_overlap'[simp] = invokeUntyped_proofs.ps_no_overlap'[OF pf] note caps_no_overlap'[simp] = invokeUntyped_proofs.caps_no_overlap'[OF pf] note ex_cte_no_overlap' = invokeUntyped_proofs.ex_cte_no_overlap'[OF pf] note cref_inv = invokeUntyped_proofs.cref_inv[OF pf] note slots_invD = invokeUntyped_proofs.slots_invD[OF pf] note nidx[simp] = add_minus_neg_mask[where ptr = ptr] note idx_compare' = invokeUntyped_proofs.idx_compare'[OF pf] have valid_global_refs': "valid_global_refs' s" using misc by auto have mapM_insertNewCap_Q:
      "\<And>caps. \<lbrace>Q\<rbrace> mapM (\<lambda>(x, y). insertNewCap cref x y) (zip slots caps) \<lbrace>\<lambda>rv. Q\<rbrace>" by (wp mapM_wp' | clarsimp)+ note reset_Q' = reset_Q[simplified ui, simplified] note neg_mask_add_mask = word_plus_and_or_coroll2
    [symmetric,where w = "mask sz" and t = ptr,symmetric] note msimp[simp add] =  misc neg_mask_add_mask show "\<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>" including no_pre apply (clarsimp simp:invokeUntyped_def getSlotCap_def ui) apply (rule validE_valid) apply (rule hoare_pre) apply (rule_tac B="\<lambda>_ s. invs' s \<and> Q s \<and> ct_active' s
          \<and> valid_untyped_inv_wcap' ui
              (Some (UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s
          \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)
          " in hoare_vcg_seqE[rotated]) apply (simp only: whenE_def) apply wp apply (rule hoare_post_impErr, rule combine_validE,
           rule resetUntypedCap_invs_etc, rule valid_validE, rule reset_Q') apply (clarsimp simp only: if_True) apply auto[1] apply simp apply wp[1] prefer 2 apply (cut_tac vui1 misc) apply (clarsimp simp: ui cte_wp_at_ctes_of simp del: misc) apply auto[1] apply (rule hoare_pre) apply (wp createNewObjects_wp_helper[where sz = sz]) apply (simp add: slots)+ apply (rule cover) apply (simp add: slots)+ apply (clarsimp simp:insertNewCaps_def) apply (wp zipWithM_x_insertNewCap_invs''
                set_tuple_pick distinct_tuple_helper
                hoare_vcg_const_Ball_lift
                createNewCaps_invs'[where sz = sz]
                createNewCaps_valid_cap[where sz = sz,OF cover]
                createNewCaps_parent_helper[where sz = sz]
                createNewCaps_cap_to'[where sz = sz]
                createNewCaps_descendants_range_ret'[where sz = sz]
                createNewCaps_caps_overlap_reserved_ret'[where sz = sz]
                createNewCaps_ranges[where sz = sz]
                createNewCaps_ranges'[where sz = sz]
                createNewCaps_IRQHandler
                createNewCaps_ct_active'[where sz=sz]
                mapM_insertNewCap_Q
          | simp add: zipWithM_x_mapM slots tps)+ apply (wp hoare_vcg_all_lift) apply (wp hoare_strengthen_post[OF createNewCaps_IRQHandler]) apply (intro impI) apply (erule impE) apply (erule(1) snd_set_zip_in_set) apply (simp add: conj_comms, wp createNew_Q[where sz=sz]) apply (wp hoare_strengthen_post[OF createNewCaps_range_helper[where sz = sz]]) apply (clarsimp simp: slots) apply (clarsimp simp:conj_comms ball_conj_distrib pred_conj_def
                   simp del:capFreeIndex_update.simps) apply (strengthen invs_pspace_aligned' invs_pspace_distinct'
                invs_valid_pspace' invs_arch_state'
                imp_consequent[where Q = "(\<exists>x. x \<in> set slots)"]
              | clarsimp simp: conj_comms simp del: capFreeIndex_update.simps)+ apply (wp updateFreeIndex_forward_invs' updateFreeIndex_caps_overlap_reserved
           updateFreeIndex_caps_no_overlap'' updateFreeIndex_pspace_no_overlap'
           hoare_vcg_const_Ball_lift
           updateFreeIndex_cte_wp_at
           updateCap_cte_cap_wp_to') apply (wp updateFreeIndex_caps_overlap_reserved
                 updateFreeIndex_descendants_range_in' getCTE_wp | simp)+ apply (clarsimp simp only: ui) apply (frule(2) invokeUntyped_proofs.intro) apply (frule invokeUntyped_proofs.idx_le_new_offs) apply (frule invokeUntyped_proofs.szw) apply (frule invokeUntyped_proofs.descendants_range(2), simp) apply (frule invokeUntyped_proofs.idx_compare') apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps getFreeIndex_def
                          shiftL_nat shiftl_t2n mult.commute
                          if_split[where P="\<lambda>x. x \<le> unat v" for v]
                          invs_valid_pspace' invs_ksCurDomain_maxDomain'
                          invokeUntyped_proofs.caps_no_overlap'
                          invokeUntyped_proofs.usableRange_disjoint
               split del: if_split) apply (strengthen refl) apply simp apply (intro conjI; assumption?) apply (erule is_aligned_weaken[OF range_cover.funky_aligned]) apply (simp add: APIType_capBits_def objBits_simps' minUntypedSizeBits_def
                    split: object_type.split apiobject_type.split)[1] apply (cases reset) apply clarsimp apply (clarsimp simp: invokeUntyped_proofs.ps_no_overlap') apply (drule invs_valid_global') apply (clarsimp simp: valid_global_refs'_def cte_at_valid_cap_sizes_0) apply auto[1] apply (frule valid_global_refsD', clarsimp) apply (clarsimp simp: Int_commute) apply (erule disjoint_subset2[rotated]) apply (simp add: blah word_and_le2) apply (rule order_trans, erule invokeUntyped_proofs.subset_stuff) apply (simp add: blah word_and_le2) apply (frule valid_global_refsD2', clarsimp) apply (clarsimp simp: global_refs'_def) apply (erule notE, erule subsetD[rotated], simp add: blah word_and_le2) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and valid_untyped_inv' ui and (\<lambda>s. (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s) and Q and ct_active'\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv. invs' and Q\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. (invs' and valid_untyped_inv' ui and (\<lambda>s. (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s) and Q and ct_active') s \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv. invs' and Q\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
invs' s
Q s
ct_active' s
(case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (prove)
goal (1 subgoal):
 1. (\<And>cref reset ptr tp us slots dev. \<lbrakk>invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz idx dev; ui = Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (prove)
using this:
valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s
invs' s
Q s
ct_active' s
(case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s

goal (1 subgoal):
 1. (\<And>cref reset ptr tp us slots dev. \<lbrakk>invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz idx dev; ui = Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x3 x4 x5 x6 x7 x8. \<lbrakk>\<And>cref reset ptr tp us slots dev. \<lbrakk>invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz idx dev; x1 = cref \<and> x2 = reset \<and> x3 = ptr && ~~ mask sz \<and> x4 = ptr \<and> x5 = tp \<and> x6 = us \<and> x7 = slots \<and> x8 = dev\<rbrakk> \<Longrightarrow> thesis; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype x1 x2 x3 x4 x5 x6 x7 x8) (Some (capability.UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s; True; True; True; x2 \<longrightarrow> Q' s; ui = Invocations_H.untyped_invocation.Retype x1 x2 x3 x4 x5 x6 x7 x8; True; invs' s; Q s; ct_active' s; x2 \<longrightarrow> Q' s\<rbrakk> \<Longrightarrow> thesis proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x3 x4 x5 x6 x7 x8. \<lbrakk>\<And>cref reset ptr tp us slots dev. \<lbrakk>invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz idx dev; x1 = cref \<and> x2 = reset \<and> x3 = ptr && ~~ mask sz \<and> x4 = ptr \<and> x5 = tp \<and> x6 = us \<and> x7 = slots \<and> x8 = dev\<rbrakk> \<Longrightarrow> thesis; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype x1 x2 x3 x4 x5 x6 x7 x8) (Some (capability.UntypedCap x8 (x4 && ~~ mask sz) sz idx)) s; True; True; True; x2 \<longrightarrow> Q' s; ui = Invocations_H.untyped_invocation.Retype x1 x2 x3 x4 x5 x6 x7 x8; True; invs' s; Q s; ct_active' s; x2 \<longrightarrow> Q' s; invokeUntyped_proofs s x1 x2 x3 x4 x5 x6 x7 sz idx x8\<rbrakk> \<Longrightarrow> thesis proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x4 x5 x6 x7 x8 sza idxa. \<lbrakk>\<lbrakk>invokeUntyped_proofs s x1 x2 (x4 && ~~ mask sz) x4 x5 x6 x7 sz idx x8; x4 && ~~ mask sza = x4 && ~~ mask sz\<rbrakk> \<Longrightarrow> thesis; ui = Invocations_H.untyped_invocation.Retype x1 x2 (x4 && ~~ mask sza) x4 x5 x6 x7 x8; invs' s; Q s; ct_active' s; x2 \<longrightarrow> Q' s; invokeUntyped_proofs s x1 x2 (x4 && ~~ mask sza) x4 x5 x6 x7 sz idx x8; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap x8 (x4 && ~~ mask sza) sza idxa \<and> capability.UntypedCap x8 (x4 && ~~ mask sz) sz idx = cteCap cte) x1 s; range_cover x4 sza (APIType_capBits x5 x6) (length x7); \<not> x2 \<and> idxa \<le> unat (x4 && mask sza) \<or> x2 \<and> x4 = x4 && ~~ mask sza; x2 \<longrightarrow> descendants_of' x1 (ctes_of s) = {}; x1 \<notin> set x7; distinct x7; x5 = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < x6; x5 = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> x6 \<and> x6 \<le> maxUntypedSizeBits; \<forall>slot\<in>set x7. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set x7. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; x7 \<noteq> []; x8 \<longrightarrow> x5 = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType x5; APIType_capBits x5 x6 \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> thesis proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x4 x5 x6 x7 x8 sza idxa. \<lbrakk>\<lbrakk>invokeUntyped_proofs s x1 x2 (x4 && ~~ mask sz) x4 x5 x6 x7 sz idx x8; x4 && ~~ mask sza = x4 && ~~ mask sz\<rbrakk> \<Longrightarrow> thesis; ui = Invocations_H.untyped_invocation.Retype x1 x2 (x4 && ~~ mask sza) x4 x5 x6 x7 x8; invs' s; Q s; ct_active' s; x2 \<longrightarrow> Q' s; invokeUntyped_proofs s x1 x2 (x4 && ~~ mask sza) x4 x5 x6 x7 sz idx x8; \<exists>cte. ctes_of s x1 = Some cte \<and> cteCap cte = capability.UntypedCap x8 (x4 && ~~ mask sza) sza idxa \<and> capability.UntypedCap x8 (x4 && ~~ mask sz) sz idx = cteCap cte; range_cover x4 sza (APIType_capBits x5 x6) (length x7); \<not> x2 \<and> idxa \<le> unat (x4 && mask sza) \<or> x2 \<and> x4 = x4 && ~~ mask sza; x2 \<longrightarrow> descendants_of' x1 (ctes_of s) = {}; x1 \<notin> set x7; distinct x7; x5 = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < x6; x5 = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> x6 \<and> x6 \<le> maxUntypedSizeBits; \<forall>slot\<in>set x7. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set x7. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; x7 \<noteq> []; x8 \<longrightarrow> x5 = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType x5; APIType_capBits x5 x6 \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> thesis proof (prove)
goal:
No subgoals! proof (state)
this:
invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz idx dev
ui = Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (prove)
goal (1 subgoal):
 1. range_cover ptr sz (APIType_capBits tp us) (length slots) &&& (cref \<notin> set slots &&& distinct slots &&& slots \<noteq> []) &&& tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us &&& tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. range_cover ptr sz (APIType_capBits tp us) (length slots) &&& (cref \<notin> set slots &&& distinct slots &&& slots \<noteq> []) &&& tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us &&& tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits proof (state)
this:
range_cover ptr sz (APIType_capBits tp us) (length slots)
cref \<notin> set slots
distinct slots
slots \<noteq> []
tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us
tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
ptr \<noteq> 0

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
{ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<not> reset \<Longrightarrow> idx < 2 ^ sz proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s
ui = Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev

goal (1 subgoal):
 1. \<not> reset \<Longrightarrow> idx < 2 ^ sz proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ mask sz) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; idx \<le> unat (ptr && mask sz); cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> idx < 2 ^ sz proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ mask sz) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> unat (ptr && mask sz) < 2 ^ sz proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ mask sz) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ptr && mask sz < word_of_nat (2 ^ sz) proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ mask sz) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ptr && mask sz < 2 ^ sz proof (prove)
goal (2 subgoals):
 1. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ mask sz) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ptr && mask sz \<le> ?y29 cte
 2. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ mask sz) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ?y29 cte < 2 ^ sz proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ mask sz) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> mask sz < 2 ^ sz proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ (2 ^ sz - 1)) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ (2 ^ sz - 1)) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 2 ^ sz - 1 < 2 ^ sz proof (prove)
goal (2 subgoals):
 1. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ (2 ^ sz - 1)) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ (2 ^ sz - 1)) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 2 ^ sz \<le> 2 ^ sz
 2. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ (2 ^ sz - 1)) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ (2 ^ sz - 1)) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 2 ^ sz \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>\<not> reset; ui = Invocations_H.untyped_invocation.Retype cref False (ptr && ~~ (2 ^ sz - 1)) ptr tp us slots dev; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; cteCap cte = capability.UntypedCap dev (ptr && ~~ (2 ^ sz - 1)) sz idx; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 2 ^ sz \<noteq> 0 proof (prove)
goal:
No subgoals! proof (state)
this:
\<not> reset \<Longrightarrow> idx < 2 ^ sz

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
untyped_range (cap.UntypedCap ?dev ?p ?n ?f) = {?p..?p + (1 << ?n) - 1}
untyped_range cap.NullCap = {}
untyped_range (cap.EndpointCap ?r ?badge ?rights) = {}
untyped_range (cap.NotificationCap ?r ?badge ?rights) = {}
untyped_range (cap.CNodeCap ?r ?bits ?guard) = {}
untyped_range (cap.ThreadCap ?r) = {}
untyped_range cap.DomainCap = {}
untyped_range (cap.ReplyCap ?r ?master ?rights) = {}
untyped_range cap.IRQControlCap = {}
untyped_range (cap.IRQHandlerCap ?irq) = {}
untyped_range (cap.Zombie ?r ?b ?n) = {}
untyped_range (cap.ArchObjectCap ?cap) = {}
usable_untyped_range (cap.UntypedCap ?uu ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})
(?i \<in> {?l..?u}) = (?l \<le> ?i \<and> ?i \<le> ?u)
({?a..?b} \<subseteq> {?c..?d}) = (\<not> ?a \<le> ?b \<or> ?c \<le> ?a \<and> ?b \<le> ?d)
(?i \<in> {?l..<?u}) = (?l \<le> ?i \<and> ?i < ?u)
{?a..?b} \<inter> {?c..?d} = {max ?a ?c..min ?b ?d}
({?a..?b} = {}) = (\<not> ?a \<le> ?b)
(\<exists>x. ?P x) = (\<exists>a b. ?P (a, b))
usableUntypedRange (capability.UntypedCap ?d ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s)
descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s)

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
\<not> reset \<Longrightarrow> pspace_no_overlap' ptr sz s

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
caps_no_overlap'' ptr sz s

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
ex_cte_cap_wp_to' ?P ?p s \<Longrightarrow> ?p \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
?x \<in> set slots \<Longrightarrow> ?x \<noteq> cref \<and> ?x \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> ex_cte_cap_wp_to' (\<lambda>_. True) ?x s

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
ptr + ?a - (ptr && ~~ mask ?sz) = (ptr && mask ?sz) + ?a

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
unat ((ptr && mask sz) + (word_of_nat (length slots) << APIType_capBits tp us)) \<le> 2 ^ sz

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (prove)
goal (1 subgoal):
 1. valid_global_refs' s proof (prove)
using this:
invs' s
Q s
ct_active' s
(case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s

goal (1 subgoal):
 1. valid_global_refs' s proof (state)
this:
valid_global_refs' s

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>caps. \<lbrace>Q\<rbrace> mapM (\<lambda>(x, y). insertNewCap cref x y) (zip slots caps) \<lbrace>\<lambda>rv. Q\<rbrace> proof (state)
this:
\<lbrace>Q\<rbrace> mapM (\<lambda>(x, y). insertNewCap cref x y) (zip slots ?caps) \<lbrace>\<lambda>rv. Q\<rbrace>

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
\<lbrace>Q'\<rbrace> resetUntypedCap cref \<lbrace>\<lambda>_. Q\<rbrace>

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
(ptr && mask sz) + (ptr && ~~ mask sz) = ptr

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (state)
this:
invs' s
Q s
ct_active' s
(case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s
(ptr && mask sz) + (ptr && ~~ mask sz) = ptr

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>ct_active' s; Q s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s; invs' s; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv x. invs' x \<and> Q x\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(=) s\<rbrace> doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od)
odE \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(=) s\<rbrace> doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od)
odE \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q3\<rbrace> doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od)
odE \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 2. \<And>sa. s = sa \<Longrightarrow> ?Q3 sa proof (prove)
goal (3 subgoals):
 1. \<lbrace>?Q3\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>_ s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 2. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 3. \<And>sa. s = sa \<Longrightarrow> ?Q3 sa proof (prove)
goal (3 subgoals):
 1. \<lbrace>?Q3\<rbrace> if reset then resetUntypedCap cref else returnOk () \<lbrace>\<lambda>_ s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 2. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 3. \<And>sa. s = sa \<Longrightarrow> ?Q3 sa proof (prove)
goal (4 subgoals):
 1. reset \<Longrightarrow> \<lbrace>?Q9\<rbrace> resetUntypedCap cref \<lbrace>\<lambda>_ s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 2. \<not> reset \<Longrightarrow> \<lbrace>?R9\<rbrace> returnOk () \<lbrace>\<lambda>_ s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 3. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 4. \<And>sa. s = sa \<Longrightarrow> (reset \<longrightarrow> ?Q9 sa) \<and> (\<not> reset \<longrightarrow> ?R9 sa) proof (prove)
goal (5 subgoals):
 1. \<And>rv s. \<lbrakk>reset; (invs' and valid_untyped_inv_wcap' ?ui18 (Some (capability.UntypedCap ?dev18 ?ptr18 ?sz18 0)) and ct_active' and pspace_no_overlap' ?ptr18 ?sz18 and Q) s\<rbrakk> \<Longrightarrow> invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)
 2. \<And>e s. \<lbrakk>reset; (invs' and Q) s\<rbrakk> \<Longrightarrow> invs' s \<and> Q s
 3. \<not> reset \<Longrightarrow> \<lbrace>?R9\<rbrace> returnOk () \<lbrace>\<lambda>_ s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 4. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 5. \<And>sa. s = sa \<Longrightarrow> (reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ?ui18 (Some (capability.UntypedCap ?dev18 ?ptr18 ?sz18 ?idx18)) and ct_active' and K (\<exists>ptr_base ptr' ty us slots. ?ui18 = Invocations_H.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev18) and Q') sa) \<and> (\<not> reset \<longrightarrow> ?R9 sa) proof (prove)
goal (5 subgoals):
 1. \<And>rv s. \<lbrakk>reset; Q s; pspace_no_overlap' ?ptr18 ?sz18 s; ct_active' s; invs' s; valid_untyped_inv_wcap' ?ui18 (Some (capability.UntypedCap ?dev18 ?ptr18 ?sz18 0)) s\<rbrakk> \<Longrightarrow> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz 0)) s \<and> (True \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)
 2. \<And>e s. \<lbrakk>reset; (invs' and Q) s\<rbrakk> \<Longrightarrow> invs' s \<and> Q s
 3. \<not> reset \<Longrightarrow> \<lbrace>?R9\<rbrace> returnOk () \<lbrace>\<lambda>_ s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 4. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 5. \<And>sa. s = sa \<Longrightarrow> (reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ?ui18 (Some (capability.UntypedCap ?dev18 ?ptr18 ?sz18 ?idx18)) and ct_active' and K (\<exists>ptr_base ptr' ty us slots. ?ui18 = Invocations_H.untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev18) and Q') sa) \<and> (\<not> reset \<longrightarrow> ?R9 sa) proof (prove)
goal (4 subgoals):
 1. \<And>e s. \<lbrakk>reset; (invs' and Q) s\<rbrakk> \<Longrightarrow> invs' s \<and> Q s
 2. \<not> reset \<Longrightarrow> \<lbrace>?R9\<rbrace> returnOk () \<lbrace>\<lambda>_ s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 3. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 4. \<And>sa. s = sa \<Longrightarrow> (reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz ?idx18)) and ct_active' and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev) and Q') sa) \<and> (\<not> reset \<longrightarrow> ?R9 sa) proof (prove)
goal (3 subgoals):
 1. \<not> reset \<Longrightarrow> \<lbrace>?R9\<rbrace> returnOk () \<lbrace>\<lambda>_ s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 2. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 3. \<And>sa. s = sa \<Longrightarrow> (reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz ?idx18)) and ct_active' and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev) and Q') sa) \<and> (\<not> reset \<longrightarrow> ?R9 sa) proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 2. \<And>sa. s = sa \<Longrightarrow> (reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz ?idx18)) and ct_active' and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev) and Q') sa) \<and> (\<not> reset \<longrightarrow> invs' sa \<and> Q sa \<and> ct_active' sa \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) sa \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz sa)) proof (prove)
goal (2 subgoals):
 1. \<And>sa. s = sa \<Longrightarrow> (reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz ?idx18)) and ct_active' and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev) and Q') sa) \<and> (\<not> reset \<longrightarrow> invs' sa \<and> Q sa \<and> ct_active' sa \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) sa \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz sa))
 2. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>sa. \<lbrakk>s = sa; valid_untyped_inv_wcap' ui (Some (case ui of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s; invs' s; Q s; ct_active' s; (case ui of Invocations_H.untyped_invocation.Retype x reset xa xb xc xd xe xf \<Rightarrow> reset) \<longrightarrow> Q' s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> (invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz ?idx18)) and ct_active' and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev) and Q') sa) \<and> (\<not> reset \<longrightarrow> invs' sa \<and> Q sa \<and> ct_active' sa \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) sa \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz sa))
 2. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> Q' s; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz idx; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> ?idx18 = idx \<and> ptr = ptr && ~~ mask sz) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz))
 2. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrace>\<lambda>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s)\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrace>?Q424 x\<rbrace> liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))));
createNewObjects tp cref slots ptr us dev
od) \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>, \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 2. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s proof (prove)
goal (9 subgoals):
 1. \<And>x y ya yb. distinct slots
 2. \<And>x y ya yb. range_cover ptr sz (getObjectSize tp us) (length slots)
 3. \<And>x y ya yb. ptr \<noteq> 0
 4. \<And>x y ya yb. length slots \<noteq> 0
 5. \<And>x y ya yb. \<lbrace>?P432 x y ya yb\<rbrace> insertNewCaps tp cref slots ptr us dev \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 6. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. ?P432 x y ya yb and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 7. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 8. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 9. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s proof (prove)
goal (8 subgoals):
 1. range_cover ptr sz (APIType_capBits tp us) (length slots)
 2. \<And>x y ya yb. ptr \<noteq> 0
 3. \<And>x y ya yb. length slots \<noteq> 0
 4. \<And>x y ya yb. \<lbrace>?P432 x y ya yb\<rbrace> insertNewCaps tp cref slots ptr us dev \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 5. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. ?P432 x y ya yb and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 6. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 7. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 8. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s proof (prove)
goal (7 subgoals):
 1. \<And>x y ya yb. ptr \<noteq> 0
 2. \<And>x y ya yb. length slots \<noteq> 0
 3. \<And>x y ya yb. \<lbrace>?P432 x y ya yb\<rbrace> insertNewCaps tp cref slots ptr us dev \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 4. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. ?P432 x y ya yb and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 5. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 6. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 7. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s proof (prove)
goal (5 subgoals):
 1. \<lbrace>?P432 () () () ()\<rbrace> insertNewCaps tp cref slots ptr us dev \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 2. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. ?P432 x y ya yb and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 3. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 4. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 5. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s proof (prove)
goal (5 subgoals):
 1. \<lbrace>?P432 () () () ()\<rbrace> createNewCaps tp ptr (length slots) us dev >>= zipWithM_x (insertNewCap cref) slots \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>
 2. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. ?P432 x y ya yb and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 3. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 4. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 5. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s proof (prove)
goal (5 subgoals):
 1. \<lbrace>?P'513 () () () ()\<rbrace> createNewCaps tp ptr (length slots) us dev \<lbrace>\<lambda>rv s. (\<forall>irq. capability.IRQHandlerCap irq \<in> snd ` set (zip slots rv) \<longrightarrow> irq_issued' irq s) \<and> distinct (map fst (zip slots rv)) \<and> Q s\<rbrace>
 2. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. (\<lambda>a. ((\<lambda>s. invs' s \<and> ct_active' s \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> ptr \<noteq> 0 \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < gsMaxObjectSize s) and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> length slots \<noteq> 0)) a \<and> (ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots)) a \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 x y ya yb)) cref a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> True \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> ((range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of a)) \<and> (0 < length slots \<and> range_cover ptr (?sz504 x y ya yb) (APIType_capBits tp us) (length slots) \<and> ksIdleThread a \<notin> {ptr..(ptr && ~~ mask (?sz503 x y ya yb)) + 2 ^ ?sz502 x y ya yb - 1}) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> ?P'513 x y ya yb a) and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 3. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 4. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 5. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (6 subgoals):
 1. \<And>irq. \<lbrace>\<lambda>a. ?P526 () () () () a irq\<rbrace> createNewCaps tp ptr (length slots) us dev \<lbrace>\<lambda>a b. capability.IRQHandlerCap irq \<in> snd ` set (zip slots a) \<longrightarrow> irq_issued' irq b\<rbrace>
 2. \<lbrace>?P'523 () () () ()\<rbrace> createNewCaps tp ptr (length slots) us dev \<lbrace>\<lambda>rv s. distinct (map fst (zip slots rv)) \<and> Q s\<rbrace>
 3. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. (\<lambda>a. ((\<lambda>s. invs' s \<and> ct_active' s \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> ptr \<noteq> 0 \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < gsMaxObjectSize s) and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> length slots \<noteq> 0)) a \<and> (ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots)) a \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 x y ya yb)) cref a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> True \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> ((range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of a)) \<and> (0 < length slots \<and> range_cover ptr (?sz504 x y ya yb) (APIType_capBits tp us) (length slots) \<and> ksIdleThread a \<notin> {ptr..(ptr && ~~ mask (?sz503 x y ya yb)) + 2 ^ ?sz502 x y ya yb - 1}) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> (\<forall>xa. ?P526 x y ya yb a xa) \<and> ?P'523 x y ya yb a) and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 4. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 5. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 6. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (6 subgoals):
 1. \<And>irq rv s. capability.IRQHandlerCap (?irq531 irq) \<in> set rv \<longrightarrow> ?P531 irq rv s \<Longrightarrow> capability.IRQHandlerCap irq \<in> snd ` set (zip slots rv) \<longrightarrow> irq_issued' irq s
 2. \<lbrace>?P'523 () () () ()\<rbrace> createNewCaps tp ptr (length slots) us dev \<lbrace>\<lambda>rv s. distinct (map fst (zip slots rv)) \<and> Q s\<rbrace>
 3. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. (\<lambda>a. ((\<lambda>s. invs' s \<and> ct_active' s \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> ptr \<noteq> 0 \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < gsMaxObjectSize s) and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> length slots \<noteq> 0)) a \<and> (ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots)) a \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 x y ya yb)) cref a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> True \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> ((range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of a)) \<and> (0 < length slots \<and> range_cover ptr (?sz504 x y ya yb) (APIType_capBits tp us) (length slots) \<and> ksIdleThread a \<notin> {ptr..(ptr && ~~ mask (?sz503 x y ya yb)) + 2 ^ ?sz502 x y ya yb - 1}) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> (\<forall>x. True) \<and> ?P'523 x y ya yb a) and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 4. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 5. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 6. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (6 subgoals):
 1. \<And>irq rv s. \<lbrakk>capability.IRQHandlerCap (?irq531 irq) \<in> set rv \<longrightarrow> ?P531 irq rv s; capability.IRQHandlerCap irq \<in> snd ` set (zip slots rv)\<rbrakk> \<Longrightarrow> irq_issued' irq s
 2. \<lbrace>?P'523 () () () ()\<rbrace> createNewCaps tp ptr (length slots) us dev \<lbrace>\<lambda>rv s. distinct (map fst (zip slots rv)) \<and> Q s\<rbrace>
 3. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. (\<lambda>a. ((\<lambda>s. invs' s \<and> ct_active' s \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> ptr \<noteq> 0 \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < gsMaxObjectSize s) and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> length slots \<noteq> 0)) a \<and> (ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots)) a \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 x y ya yb)) cref a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> True \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> ((range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of a)) \<and> (0 < length slots \<and> range_cover ptr (?sz504 x y ya yb) (APIType_capBits tp us) (length slots) \<and> ksIdleThread a \<notin> {ptr..(ptr && ~~ mask (?sz503 x y ya yb)) + 2 ^ ?sz502 x y ya yb - 1}) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> (\<forall>x. True) \<and> ?P'523 x y ya yb a) and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 4. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 5. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 6. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (7 subgoals):
 1. \<And>irq rv s. capability.IRQHandlerCap irq \<in> snd ` set (zip slots rv) \<Longrightarrow> capability.IRQHandlerCap (?irq531 irq) \<in> set rv
 2. \<And>irq rv s. \<lbrakk>capability.IRQHandlerCap irq \<in> snd ` set (zip slots rv); ?P531 irq rv s\<rbrakk> \<Longrightarrow> irq_issued' irq s
 3. \<lbrace>?P'523 () () () ()\<rbrace> createNewCaps tp ptr (length slots) us dev \<lbrace>\<lambda>rv s. distinct (map fst (zip slots rv)) \<and> Q s\<rbrace>
 4. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. (\<lambda>a. ((\<lambda>s. invs' s \<and> ct_active' s \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> ptr \<noteq> 0 \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < gsMaxObjectSize s) and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> length slots \<noteq> 0)) a \<and> (ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots)) a \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 x y ya yb)) cref a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> True \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> ((range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of a)) \<and> (0 < length slots \<and> range_cover ptr (?sz504 x y ya yb) (APIType_capBits tp us) (length slots) \<and> ksIdleThread a \<notin> {ptr..(ptr && ~~ mask (?sz503 x y ya yb)) + 2 ^ ?sz502 x y ya yb - 1}) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> (\<forall>x. True) \<and> ?P'523 x y ya yb a) and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 5. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 6. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 7. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (5 subgoals):
 1. \<lbrace>?P'523 () () () ()\<rbrace> createNewCaps tp ptr (length slots) us dev \<lbrace>\<lambda>rv s. distinct (map fst (zip slots rv)) \<and> Q s\<rbrace>
 2. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. (\<lambda>a. ((\<lambda>s. invs' s \<and> ct_active' s \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> ptr \<noteq> 0 \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < gsMaxObjectSize s) and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> length slots \<noteq> 0)) a \<and> (ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots)) a \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 x y ya yb)) cref a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> True \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> ((range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of a)) \<and> (0 < length slots \<and> range_cover ptr (?sz504 x y ya yb) (APIType_capBits tp us) (length slots) \<and> ksIdleThread a \<notin> {ptr..(ptr && ~~ mask (?sz503 x y ya yb)) + 2 ^ ?sz502 x y ya yb - 1}) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> (\<forall>x. True) \<and> ?P'523 x y ya yb a) and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 3. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 4. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 5. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (5 subgoals):
 1. \<lbrace>?P'540 () () () ()\<rbrace> createNewCaps tp ptr (length slots) us dev \<lbrace>\<lambda>rv s. distinct (map fst (zip slots rv))\<rbrace>
 2. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. (\<lambda>a. ((\<lambda>s. invs' s \<and> ct_active' s \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> ptr \<noteq> 0 \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < gsMaxObjectSize s) and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> length slots \<noteq> 0)) a \<and> (ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots)) a \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 x y ya yb)) cref a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> True \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> ((range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of a)) \<and> (0 < length slots \<and> range_cover ptr (?sz504 x y ya yb) (APIType_capBits tp us) (length slots) \<and> ksIdleThread a \<notin> {ptr..(ptr && ~~ mask (?sz503 x y ya yb)) + 2 ^ ?sz502 x y ya yb - 1}) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> (\<forall>x. True) \<and> (Q a \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < length slots \<and> valid_pspace' a \<and> pspace_no_overlap' ptr sz a) \<and> ?P'540 x y ya yb a) and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 3. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 4. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 5. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (5 subgoals):
 1. \<And>rv s. \<exists>capfn. rv = map capfn (map (\<lambda>p. ptr_add ptr (p * 2 ^ APIType_capBits tp us)) [0..<length slots]) \<and> (\<forall>p. capClass (capfn p) = PhysicalClass \<and> global.capUntypedPtr (capfn p) = p \<and> capBits (capfn p) = APIType_capBits tp us) \<Longrightarrow> distinct (map fst (zip slots rv))
 2. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. (\<lambda>a. ((\<lambda>s. invs' s \<and> ct_active' s \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> ptr \<noteq> 0 \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < gsMaxObjectSize s) and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> length slots \<noteq> 0)) a \<and> (ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots)) a \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 x y ya yb)) cref a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> True \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> ((range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of a)) \<and> (0 < length slots \<and> range_cover ptr (?sz504 x y ya yb) (APIType_capBits tp us) (length slots) \<and> ksIdleThread a \<notin> {ptr..(ptr && ~~ mask (?sz503 x y ya yb)) + 2 ^ ?sz502 x y ya yb - 1}) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> (\<forall>x. True) \<and> (Q a \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < length slots \<and> valid_pspace' a \<and> pspace_no_overlap' ptr sz a) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 3. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 4. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 5. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (4 subgoals):
 1. \<And>x y ya. \<lbrace>?B430 x y ya\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb. (\<lambda>a. ((\<lambda>s. invs' s \<and> ct_active' s \<and> pspace_no_overlap' ptr sz s \<and> caps_no_overlap'' ptr sz s \<and> ptr \<noteq> 0 \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < gsMaxObjectSize s) and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> length slots \<noteq> 0)) a \<and> (ct_active' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots)) a \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 x y ya yb)) cref a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> True \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a) \<and> ((range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of a)) \<and> (0 < length slots \<and> range_cover ptr (?sz504 x y ya yb) (APIType_capBits tp us) (length slots) \<and> ksIdleThread a \<notin> {ptr..(ptr && ~~ mask (?sz503 x y ya yb)) + 2 ^ ?sz502 x y ya yb - 1}) \<and> (caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' ptr sz a \<and> 0 < length slots \<and> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> (range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) \<and> (\<forall>x. True) \<and> (Q a \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> 0 < length slots \<and> valid_pspace' a \<and> pspace_no_overlap' ptr sz a) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> 0 < length slots) and (cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref and (\<lambda>s. \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and valid_pspace' and valid_arch_state' and caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ getObjectSize tp us - 1} and (\<lambda>s. ksCurDomain s \<le> maxDomain))\<rbrace>
 2. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 3. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 4. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (4 subgoals):
 1. \<lbrace>?B430 () () ()\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>yb x. invs' x \<and> pspace_aligned' x \<and> pspace_distinct' x \<and> valid_arch_state' x \<and> valid_pspace' x \<and> Q x \<and> slots \<noteq> [] \<and> pspace_no_overlap' ptr sz x \<and> 0 < gsMaxObjectSize x \<and> ksCurDomain x \<le> maxDomain \<and> caps_no_overlap'' ptr sz x \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref x \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> ((\<exists>x. x \<in> set slots) \<longrightarrow> pspace_aligned' x) \<and> ((\<exists>x. x \<in> set slots) \<longrightarrow> pspace_distinct' x) \<and> (\<forall>xa\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) xa x) \<and> ct_active' x \<and> ((\<exists>x. x \<in> set slots) \<longrightarrow> slots \<noteq> []) \<and> ((\<exists>x. x \<in> set slots) \<longrightarrow> pspace_no_overlap' ptr sz x) \<and> range_cover ptr (?sz504 () () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot x) \<and> ((\<exists>x. x \<in> set slots) \<longrightarrow> range_cover ptr sz (APIType_capBits tp us) (length slots)) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} x \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 () () () ())) cref x \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of x) \<and> ksIdleThread x \<notin> {ptr..(ptr && ~~ mask (?sz503 () () () ())) + 2 ^ ?sz502 () () () () - 1}\<rbrace>
 2. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 3. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 4. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (4 subgoals):
 1. \<lbrace>?B430 () () ()\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>r s. invs' s \<and> Q s \<and> slots \<noteq> [] \<and> pspace_no_overlap' ptr sz s \<and> 0 < gsMaxObjectSize s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap c)) cref s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> ct_active' s \<and> range_cover ptr (?sz504 () () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> caps_overlap_reserved' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx471 () () () ())) cref s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz503 () () () ())) + 2 ^ ?sz502 () () () () - 1}\<rbrace>
 2. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B430 x y\<rbrace>
 3. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 4. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (4 subgoals):
 1. \<lbrace>?P'728 () () ()\<rbrace> updateFreeIndex cref (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) \<lbrace>\<lambda>rv s. descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz503 () () () ())) + 2 ^ ?sz502 () () () () - 1}\<rbrace>
 2. \<And>x y. \<lbrace>?B429 x y\<rbrace> stateAssert (\<lambda>s. \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>\<lambda>a b. (invs' b \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))))) minUntypedSizeBits) \<circ> cteCap) cref b) \<and> (invs' and Q) b \<and> slots \<noteq> [] \<and> (pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) cref b) \<and> 0 < gsMaxObjectSize b \<and> ksCurDomain b \<le> maxDomain \<and> (caps_no_overlap'' ptr sz b \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) cref b) \<and> cte_wp_at' (\<lambda>c. isUntypedCap (cteCap (cteCap_update (if cref = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) else id) c))) cref b \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isUntypedCap \<circ> cteCap) cref b \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x b) \<and> ct_active' b \<and> range_cover ptr (?sz711 x y a) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) else id) c) = capability.NullCap) x b) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> (valid_pspace' b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of b) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) cap) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) cref b) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cref = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) else id) c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx734 x y a)) cref b \<and> ?P'728 x y a b\<rbrace>
 3. \<And>x. \<lbrace>?Q424 x\<rbrace> stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)) [] \<lbrace>?B429 x\<rbrace>
 4. \<And>x s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> ?Q424 x s
flex-flex pairs:
?idx734 () () () \<equiv>\<^sup>? ?idx471 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s. invs' s \<and> Q s \<and> ct_active' s \<and> valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s \<and> (reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s) \<Longrightarrow> \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1) \<longrightarrow> \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1) \<longrightarrow> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))))) minUntypedSizeBits) cref s \<and> slots \<noteq> [] \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> 0 < gsMaxObjectSize s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c))) cref s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. (x = cref \<longrightarrow> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.NullCap) cref s) \<and> (x \<noteq> cref \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s)) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx734 () () ())) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?idx734 () () () \<equiv>\<^sup>? ?idx471 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; Q s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))))) minUntypedSizeBits) cref s \<and> slots \<noteq> [] \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> 0 < gsMaxObjectSize s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c))) cref s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. (x = cref \<longrightarrow> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.NullCap) cref s) \<and> (x \<noteq> cref \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s)) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx734 () () ())) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?idx734 () () () \<equiv>\<^sup>? ?idx471 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; Q s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))))) minUntypedSizeBits) cref s \<and> slots \<noteq> [] \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> 0 < gsMaxObjectSize s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c))) cref s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. (x = cref \<longrightarrow> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.NullCap) cref s) \<and> (x \<noteq> cref \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s)) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx734 () () ())) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?idx734 () () () \<equiv>\<^sup>? ?idx471 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; Q s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> (if reset then 0 else idx) \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))))) minUntypedSizeBits) cref s \<and> slots \<noteq> [] \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> 0 < gsMaxObjectSize s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c))) cref s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. (x = cref \<longrightarrow> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.NullCap) cref s) \<and> (x \<noteq> cref \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s)) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx734 () () ())) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?idx734 () () () \<equiv>\<^sup>? ?idx471 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; Q s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev) (Some (capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> (if reset then 0 else idx) \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))))) minUntypedSizeBits) cref s \<and> slots \<noteq> [] \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> 0 < gsMaxObjectSize s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c))) cref s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. (x = cref \<longrightarrow> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.NullCap) cref s) \<and> (x \<noteq> cref \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s)) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx734 () () ())) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s) \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?idx734 () () () \<equiv>\<^sup>? ?idx471 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; Q s; ct_active' s; \<exists>sza idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx) = cteCap cte) cref s \<and> range_cover ptr sza (APIType_capBits tp us) (length slots) \<and> (\<not> reset \<and> idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz) \<and> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> (reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}) \<and> cref \<notin> set slots \<and> distinct slots \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp) \<and> APIType_capBits tp us \<le> maxUntypedSizeBits; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))))) minUntypedSizeBits) cref s \<and> slots \<noteq> [] \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> 0 < gsMaxObjectSize s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c))) cref s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. (x = cref \<longrightarrow> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.NullCap) cref s) \<and> (x \<noteq> cref \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s)) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx734 () () ())) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?idx734 () () () \<equiv>\<^sup>? ?idx471 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; Q s; ct_active' s; \<exists>sza idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sza idxa \<and> capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx) = cteCap cte) cref s \<and> range_cover ptr sza (APIType_capBits tp us) (length slots) \<and> (\<not> reset \<and> idxa \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz) \<and> ptr && ~~ mask sza = ptr && ~~ mask sz \<and> (reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}) \<and> cref \<notin> set slots \<and> distinct slots \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp) \<and> APIType_capBits tp us \<le> maxUntypedSizeBits; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)) - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + (word_of_nat (length slots) << APIType_capBits tp us)) \<le> 2 ^ sz\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us))))) minUntypedSizeBits) cref s \<and> slots \<noteq> [] \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> 0 < gsMaxObjectSize s \<and> ksCurDomain s \<le> maxDomain \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. isUntypedCap (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c))) cref s \<and> (tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> range_cover ptr sz (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. (x = cref \<longrightarrow> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.NullCap) cref s) \<and> (x \<noteq> cref \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s)) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length slots) (APIType_capBits tp us)))) (cteCap c) = capability.UntypedCap dev (ptr && ~~ mask sz) sz (?idx734 () () ())) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?idx734 () () () \<equiv>\<^sup>? ?idx471 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) minUntypedSizeBits \<and> pspace_no_overlap' ptr sz s \<and> 0 < gsMaxObjectSize s \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. x \<noteq> cref) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) = ?idx734 () () () \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?idx734 () () () \<equiv>\<^sup>? ?idx471 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) minUntypedSizeBits \<and> pspace_no_overlap' ptr sz s \<and> 0 < gsMaxObjectSize s \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. x \<noteq> cref) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> True \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (1 subgoal):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) minUntypedSizeBits \<and> pspace_no_overlap' ptr sz s \<and> 0 < gsMaxObjectSize s \<and> range_cover ptr (?sz711 () () ()) (APIType_capBits tp us) (length slots) \<and> (\<forall>x\<in>set slots. x \<noteq> cref) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask (?sz749 () () ())) + 2 ^ ?sz748 () () () - 1}
flex-flex pairs:
?sz749 () () () \<equiv>\<^sup>? ?sz503 () () () ()
?sz748 () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz711 () () () \<equiv>\<^sup>? ?sz504 () () () ()
?sz504 () () () () \<equiv>\<^sup>? ?sz502 () () () ()
?sz503 () () () () \<equiv>\<^sup>? ?sz502 () () () () proof (prove)
goal (7 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) minUntypedSizeBits
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 0 < gsMaxObjectSize s
 4. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. x \<noteq> cref
 5. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 6. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (7 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> APIType_capBits tp us
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 0 < gsMaxObjectSize s
 4. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. x \<noteq> cref
 5. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 6. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (6 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 0 < gsMaxObjectSize s
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. x \<noteq> cref
 4. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 5. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (7 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits; reset\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits; \<not> reset\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 0 < gsMaxObjectSize s
 4. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. x \<noteq> cref
 5. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 6. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (6 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits; \<not> reset\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 0 < gsMaxObjectSize s
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. x \<noteq> cref
 4. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 5. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (5 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> 0 < gsMaxObjectSize s
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. x \<noteq> cref
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 4. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (5 subgoals):
 1. \<And>s cte. \<lbrakk>Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits; valid_global_refs' s\<rbrakk> \<Longrightarrow> 0 < gsMaxObjectSize s
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. x \<noteq> cref
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 4. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (4 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<forall>x\<in>set slots. x \<noteq> cref
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits; kernel_data_refs \<inter> capRange (cteCap cte) = {} \<and> global_refs' s \<subseteq> kernel_data_refs\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<inter> kernel_data_refs = {}
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits; kernel_data_refs \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; global_refs' s \<subseteq> kernel_data_refs\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits; global_refs' s \<subseteq> kernel_data_refs\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (2 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (2 subgoals):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (1 subgoal):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (1 subgoal):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits; global_refs' s \<inter> capRange (cteCap cte) = {}\<rbrakk> \<Longrightarrow> ksIdleThread s \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (1 subgoal):
 1. \<And>s cte. \<lbrakk>invs' s; Q s; ct_active' s; reset \<longrightarrow> pspace_no_overlap' (ptr && ~~ mask sz) sz s; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); \<not> archOverlap s (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1); invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length slots) * 2 ^ APIType_capBits tp us - 1} cref (ctes_of s); unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ APIType_capBits tp us) \<le> 2 ^ sz; range_cover ptr sz (APIType_capBits tp us) (length slots); ctes_of s cref = Some cte; \<not> reset \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set slots; distinct slots; tp = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> tp = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType tp; APIType_capBits tp us \<le> maxUntypedSizeBits; ksIdleThread s \<notin> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}; (page_directory_refs' (armKSGlobalPD (ksArchState s)) \<union> \<Union> (page_table_refs' ` set (armKSGlobalPTs (ksArchState s))) \<union> range (\<lambda>irq. irq_node' s + (UCAST(10 \<rightarrow> 32) irq << cteSizeBits))) \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; ksIdleThread s \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>(=) s\<rbrace> invokeUntyped ui \<lbrace>\<lambda>rv s. invs' s \<and> Q s\<rbrace>

goal:
No subgoals!