theory ArchRetype_IF

lemma invoke_untyped_reads_respects_g_wcap[Retype_IF_assms]:
  notes blah[simp del] = untyped_range.simps usable_untyped_range.simps atLeastAtMost_iff
                         atLeastatMost_subset_iff atLeastLessThan_iff Int_atLeastAtMost
                         atLeastatMost_empty_iff split_paired_Ex
  shows "reads_respects_g aag (l :: 'a subject_label)
           (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx))
                 and only_timer_irq_inv irq st and ct_active and pas_refined aag
                 and K (authorised_untyped_inv aag ui))
           (invoke_untyped ui)" apply (case_tac ui) apply (rename_tac cslot_ptr reset ptr_base ptr' apiobject_type nat list dev') apply (case_tac "\<not> (dev' = dev \<and> ptr = ptr' && ~~ mask sz)") 
   (* contradictory *)
    apply (rule equiv_valid_guard_imp, rule_tac gen_asm_ev'[where P="\<top>" and Q=False], simp) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (simp add: invoke_untyped_def mapM_x_def[symmetric]) apply (wpsimp wp: mapM_x_ev'' create_cap_reads_respects_g
                    hoare_vcg_ball_lift init_arch_objects_reads_respects_g)+ apply (rule_tac Q="\<lambda>_. invs" in hoare_strengthen_post) apply (wp init_arch_objects_invs_from_restricted) apply (fastforce simp: invs_def) apply (wp retype_region_reads_respects_g[where sz=sz and slot="slot_of_untyped_inv ui"]) apply (rule_tac Q="\<lambda>rvc s. (\<forall>x\<in>set rvc. is_subject aag x) \<and>
                                    (\<forall>x\<in>set rvc. is_aligned x (obj_bits_api apiobject_type nat)) \<and>
                                    ((0::obj_ref) < of_nat (length list)) \<and>
                                    post_retype_invs apiobject_type rvc s \<and>
                                    global_refs s \<inter> set rvc = {} \<and>
                                    (\<forall>x\<in>set list. is_subject aag (fst x))"
                     for sz in hoare_strengthen_post) apply (wp retype_region_ret_is_subject[where sz=sz, simplified]
                   retype_region_global_refs_disjoint[where sz=sz]
                   retype_region_ret_pd_aligned[where sz=sz]
                   retype_region_aligned_for_init[where sz=sz]
                   retype_region_post_retype_invs_spec[where sz=sz]) apply (fastforce simp: global_refs_def obj_bits_api_def pd_bits_def
                                pageBits_def default_arch_object_def
                         intro: post_retype_invs_pspace_alignedI
                                post_retype_invs_valid_arch_stateI
                          elim: in_set_zipE) apply (rule set_cap_reads_respects_g) apply simp apply (wp hoare_vcg_ex_lift set_cap_cte_wp_at_cases
                 hoare_vcg_disj_lift set_cap_no_overlap
                 set_free_index_invs_UntypedCap
                 set_untyped_cap_caps_overlap_reserved
                 set_cap_caps_no_overlap
                 region_in_kernel_window_preserved) apply (wp when_ev delete_objects_reads_respects_g hoare_vcg_disj_lift
                delete_objects_pspace_no_overlap
                delete_objects_descendants_range_in
                delete_objects_caps_no_overlap
                region_in_kernel_window_preserved
                get_cap_reads_respects_g get_cap_wp
             | simp split del: if_split)+ apply (rule reset_untyped_cap_reads_respects_g[where irq=irq and st=st]) apply (rule_tac P="authorised_untyped_inv aag ui \<and>
                      (\<forall>p \<in> ptr_range ptr sz. is_subject aag p)" in hoare_gen_asmE) apply (rule validE_validE_R,
          rule_tac E="\<top>\<top>"
               and Q="\<lambda>_. invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (If reset 0 idx)))
                               and ct_active
                               and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr .. ptr + 2 ^ sz - 1} s)"
                in hoare_post_impErr) apply (rule hoare_pre, wp whenE_wp) apply (rule validE_validE_R, rule hoare_post_impErr, rule reset_untyped_cap_invs_etc) apply (clarsimp simp only: if_True simp_thms, intro conjI, assumption+) apply simp apply assumption apply clarify apply (frule(2) invoke_untyped_proofs.intro) apply (clarsimp simp: cte_wp_at_caps_of_state bits_of_def
                          free_index_of_def untyped_range_def
                          if_split[where P="\<lambda>x. x \<le> unat v" for v]
               split del: if_split) apply (frule(1) valid_global_refsD2[OF _ invs_valid_global_refs]) apply (strengthen refl) apply (strengthen invs_valid_global_objs invs_arch_state) apply (clarsimp simp: authorised_untyped_inv_def conj_comms invoke_untyped_proofs.simps) apply (simp add: arg_cong[OF mask_out_sub_mask, where f="\<lambda>y. x - y" for x]
                       field_simps invoke_untyped_proofs.idx_le_new_offs
                       invoke_untyped_proofs.idx_compare' untyped_range_def) apply (strengthen caps_region_kernel_window_imp[mk_strg I E]) apply (simp add: invoke_untyped_proofs.simps untyped_range_def invs_cap_refs_in_kernel_window
                     atLeastatMost_subset_iff[where b=x and d=x for x]
               cong: conj_cong split del: if_split) apply (intro conjI) 
          (* mostly clagged from Untyped_AI *)
           apply (simp add: atLeastatMost_subset_iff word_and_le2) apply (case_tac reset) apply (clarsimp elim!: pspace_no_overlap_subset del: subsetI
                           simp: blah word_and_le2) apply (drule invoke_untyped_proofs.ps_no_overlap) apply (simp add: field_simps) apply (simp add: Int_commute, erule disjoint_subset2[rotated]) apply (simp add: atLeastatMost_subset_iff word_and_le2) apply (clarsimp dest!: invoke_untyped_proofs.idx_le_new_offs) apply (simp add: ptr_range_def) apply (erule ball_subset, rule range_subsetI[OF _ order_refl]) apply (simp add: word_and_le2) apply (erule order_trans[OF invoke_untyped_proofs.subset_stuff]) apply (simp add: atLeastatMost_subset_iff word_and_le2) apply (drule invoke_untyped_proofs.usable_range_disjoint) apply (clarsimp simp: field_simps mask_out_sub_mask shiftl_t2n) apply blast apply (clarsimp simp: cte_wp_at_caps_of_state authorised_untyped_inv_def) apply (strengthen refl) apply (frule(1) cap_auth_caps_of_state) apply (simp add: aag_cap_auth_def untyped_range_def
                   aag_has_Control_iff_owns ptr_range_def[symmetric]) apply (erule disjE, simp_all)[1] done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) (invoke_untyped ui) proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x3 x4 x5 x6 x7 x8. ui = Retype x1 x2 x3 x4 x5 x6 x7 x8 \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) (invoke_untyped ui) proof (prove)
goal (1 subgoal):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'. ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev' \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) (invoke_untyped ui) proof (prove)
goal (2 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'; \<not> (dev' = dev \<and> ptr = ptr' && ~~ mask sz)\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) (invoke_untyped ui)
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'; \<not> \<not> (dev' = dev \<and> ptr = ptr' && ~~ mask sz)\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) (invoke_untyped ui) proof (prove)
goal (2 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'; \<not> (dev' = dev \<and> ptr = ptr' && ~~ mask sz)\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) (invoke_untyped ui)
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'; \<not> \<not> (dev' = dev \<and> ptr = ptr' && ~~ mask sz)\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) (invoke_untyped ui) proof (prove)
goal (2 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list dev' s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'; \<not> (dev' = dev \<and> ptr = ptr' && ~~ mask sz); (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and K False) s
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'; \<not> \<not> (dev' = dev \<and> ptr = ptr' && ~~ mask sz)\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) (invoke_untyped ui) proof (prove)
goal (1 subgoal):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev'; \<not> \<not> (dev' = dev \<and> ptr = ptr' && ~~ mask sz)\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz idx)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and K (authorised_untyped_inv aag ui)) (invoke_untyped ui) proof (prove)
goal (1 subgoal):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) (doE y <- whenE reset (reset_untyped_cap cslot_ptr);
liftE (do cap <- get_cap cslot_ptr;
y <- set_cap (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr;
orefs <- retype_region ptr' (length list) nat apiobject_type dev;
y <- init_arch_objects apiobject_type ptr' (length list) nat orefs;
mapM_x (create_cap apiobject_type nat cslot_ptr dev) (zip list orefs)
od)
odE) proof (prove)
goal (10 subgoals):
 1. \<And>a b reset ptr_base ptr' apiobject_type nat list rva rvc aa ba bb. \<lbrakk>ui = Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; ((aa, ba), bb) \<in> set (zip list rvc)\<rbrakk> \<Longrightarrow> \<lbrace>?P'45 aa ba (aa, ba) bb a b (a, b) reset ptr_base ptr' apiobject_type nat list () rva () rvc ((aa, ba), bb)\<rbrace> init_arch_objects apiobject_type ptr' (length list) nat rvc \<lbrace>\<lambda>rv s. valid_global_objs s \<and> valid_arch_state s\<rbrace>
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb) (retype_region ptr' (length list) nat apiobject_type dev)
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb\<rbrace> retype_region ptr' (length list) nat apiobject_type dev \<lbrace>\<lambda>rvc s. ((\<lambda>s. arm_global_pd (arch_state s) \<notin> set rvc \<and> pspace_aligned s \<and> valid_arch_state s) and K (\<forall>x\<in>set rvc. is_subject aag x) and K (\<forall>x\<in>set rvc. apiobject_type = ArchObject PageDirectoryObj \<longrightarrow> is_aligned x pd_bits) and K (0 < word_of_nat (length list))) s \<and> (\<forall>x\<in>set (zip list rvc). K (is_subject aag (fst (fst x))) s \<and> ?P'45 (fst (fst x)) (snd (fst x)) (fst x) (snd x) (fst cslot_ptr) (snd cslot_ptr) cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb rvc x s)\<rbrace>
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva) (set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr)
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. ?P'13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s \<and> ?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s\<rbrace>
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. ?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 9. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 10. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s proof (prove)
goal (11 subgoals):
 1. \<And>a b reset ptr_base ptr' apiobject_type nat list rva rvc aa ba bb. \<lbrakk>ui = Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; ((aa, ba), bb) \<in> set (zip list rvc)\<rbrakk> \<Longrightarrow> \<lbrace>?P'49 aa ba (aa, ba) a b bb (a, b) reset ptr_base ptr' apiobject_type nat list () rva () rvc ((aa, ba), bb)\<rbrace> init_arch_objects apiobject_type ptr' (length list) nat rvc \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>a b reset ptr_base ptr' apiobject_type nat list rva rvc aa ba bb rv s. \<lbrakk>ui = Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; ((aa, ba), bb) \<in> set (zip list rvc); invs s\<rbrakk> \<Longrightarrow> valid_global_objs s \<and> valid_arch_state s
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb) (retype_region ptr' (length list) nat apiobject_type dev)
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb\<rbrace> retype_region ptr' (length list) nat apiobject_type dev \<lbrace>\<lambda>rvc s. ((\<lambda>s. arm_global_pd (arch_state s) \<notin> set rvc \<and> pspace_aligned s \<and> valid_arch_state s) and K (\<forall>x\<in>set rvc. is_subject aag x) and K (\<forall>x\<in>set rvc. apiobject_type = ArchObject PageDirectoryObj \<longrightarrow> is_aligned x pd_bits) and K (0 < word_of_nat (length list))) s \<and> (\<forall>x\<in>set (zip list rvc). K (is_subject aag (fst (fst x))) s \<and> ?P'49 (fst (fst x)) (snd (fst x)) (fst x) (fst cslot_ptr) (snd cslot_ptr) (snd x) cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb rvc x s)\<rbrace>
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva) (set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr)
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. ?P'13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s \<and> ?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s\<rbrace>
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. ?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 9. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 10. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b reset ptr_base ptr' apiobject_type nat list rva rvc aa ba bb rv s. \<lbrakk>ui = Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; ((aa, ba), bb) \<in> set (zip list rvc); invs s\<rbrakk> \<Longrightarrow> valid_global_objs s \<and> valid_arch_state s
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb) (retype_region ptr' (length list) nat apiobject_type dev)
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb\<rbrace> retype_region ptr' (length list) nat apiobject_type dev \<lbrace>\<lambda>rvc s. ((\<lambda>s. arm_global_pd (arch_state s) \<notin> set rvc \<and> pspace_aligned s \<and> valid_arch_state s) and K (\<forall>x\<in>set rvc. is_subject aag x) and K (\<forall>x\<in>set rvc. apiobject_type = ArchObject PageDirectoryObj \<longrightarrow> is_aligned x pd_bits) and K (0 < word_of_nat (length list))) s \<and> (\<forall>x\<in>set (zip list rvc). K (is_subject aag (fst (fst x))) s \<and> (post_retype_invs apiobject_type rvc and (\<lambda>s. global_refs s \<inter> set rvc = {}) and K (\<forall>ref\<in>set rvc. is_aligned ref (obj_bits_api apiobject_type nat))) s)\<rbrace>
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva) (set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr)
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. ?P'13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s \<and> ?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s\<rbrace>
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. ?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 9. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 10. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s proof (prove)
goal (9 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb) (retype_region ptr' (length list) nat apiobject_type dev)
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb\<rbrace> retype_region ptr' (length list) nat apiobject_type dev \<lbrace>\<lambda>rvc s. ((\<lambda>s. arm_global_pd (arch_state s) \<notin> set rvc \<and> pspace_aligned s \<and> valid_arch_state s) and K (\<forall>x\<in>set rvc. is_subject aag x) and K (\<forall>x\<in>set rvc. apiobject_type = ArchObject PageDirectoryObj \<longrightarrow> is_aligned x pd_bits) and K (0 < word_of_nat (length list))) s \<and> (\<forall>x\<in>set (zip list rvc). K (is_subject aag (fst (fst x))) s \<and> (post_retype_invs apiobject_type rvc and (\<lambda>s. global_refs s \<inter> set rvc = {}) and K (\<forall>ref\<in>set rvc. is_aligned ref (obj_bits_api apiobject_type nat))) s)\<rbrace>
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva) (set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr)
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. ?P'13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s \<and> ?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s\<rbrace>
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. ?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 9. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s proof (prove)
goal (8 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb\<rbrace> retype_region ptr' (length list) nat apiobject_type dev \<lbrace>\<lambda>rvc s. ((\<lambda>s. arm_global_pd (arch_state s) \<notin> set rvc \<and> pspace_aligned s \<and> valid_arch_state s) and K (\<forall>x\<in>set rvc. is_subject aag x) and K (\<forall>x\<in>set rvc. apiobject_type = ArchObject PageDirectoryObj \<longrightarrow> is_aligned x pd_bits) and K (0 < word_of_nat (length list))) s \<and> (\<forall>x\<in>set (zip list rvc). K (is_subject aag (fst (fst x))) s \<and> (post_retype_invs apiobject_type rvc and (\<lambda>s. global_refs s \<inter> set rvc = {}) and K (\<forall>ref\<in>set rvc. is_aligned ref (obj_bits_api apiobject_type nat))) s)\<rbrace>
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva) (set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr)
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. ((\<lambda>s. \<exists>idx. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sz idx) (slot_of_untyped_inv ui) s \<and> (idx \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) and invs and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < length list)) s \<and> ?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s\<rbrace>
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. ?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s proof (prove)
goal (9 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb\<rbrace> retype_region ptr' (length list) nat apiobject_type dev \<lbrace>\<lambda>rvc s. (\<forall>x\<in>set rvc. is_subject aag x) \<and> (\<forall>x\<in>set rvc. is_aligned x (obj_bits_api apiobject_type nat)) \<and> 0 < word_of_nat (length list) \<and> post_retype_invs apiobject_type rvc s \<and> global_refs s \<inter> set rvc = {} \<and> (\<forall>x\<in>set list. is_subject aag (fst x))\<rbrace>
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb rvc s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (\<forall>x\<in>set rvc. is_subject aag x) \<and> (\<forall>x\<in>set rvc. is_aligned x (obj_bits_api apiobject_type nat)) \<and> 0 < word_of_nat (length list) \<and> post_retype_invs apiobject_type rvc s \<and> global_refs s \<inter> set rvc = {} \<and> (\<forall>x\<in>set list. is_subject aag (fst x))\<rbrakk> \<Longrightarrow> ((\<lambda>s. arm_global_pd (arch_state s) \<notin> set rvc \<and> pspace_aligned s \<and> valid_arch_state s) and K (\<forall>x\<in>set rvc. is_subject aag x) and K (\<forall>x\<in>set rvc. apiobject_type = ArchObject PageDirectoryObj \<longrightarrow> is_aligned x pd_bits) and K (0 < word_of_nat (length list))) s \<and> (\<forall>x\<in>set (zip list rvc). K (is_subject aag (fst (fst x))) s \<and> (post_retype_invs apiobject_type rvc and (\<lambda>s. global_refs s \<inter> set rvc = {}) and K (\<forall>ref\<in>set rvc. is_aligned ref (obj_bits_api apiobject_type nat))) s)
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva) (set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr)
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. ((\<lambda>s. \<exists>idx. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sz idx) (slot_of_untyped_inv ui) s \<and> (idx \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) and invs and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < length list)) s \<and> ?P''13 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb s\<rbrace>
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. ?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 9. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s proof (prove)
goal (8 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb rvc s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (\<forall>x\<in>set rvc. is_subject aag x) \<and> (\<forall>x\<in>set rvc. is_aligned x (obj_bits_api apiobject_type nat)) \<and> 0 < word_of_nat (length list) \<and> post_retype_invs apiobject_type rvc s \<and> global_refs s \<inter> set rvc = {} \<and> (\<forall>x\<in>set list. is_subject aag (fst x))\<rbrakk> \<Longrightarrow> ((\<lambda>s. arm_global_pd (arch_state s) \<notin> set rvc \<and> pspace_aligned s \<and> valid_arch_state s) and K (\<forall>x\<in>set rvc. is_subject aag x) and K (\<forall>x\<in>set rvc. apiobject_type = ArchObject PageDirectoryObj \<longrightarrow> is_aligned x pd_bits) and K (0 < word_of_nat (length list))) s \<and> (\<forall>x\<in>set (zip list rvc). K (is_subject aag (fst (fst x))) s \<and> (post_retype_invs apiobject_type rvc and (\<lambda>s. global_refs s \<inter> set rvc = {}) and K (\<forall>ref\<in>set rvc. is_aligned ref (obj_bits_api apiobject_type nat))) s)
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva) (set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr)
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. ((\<lambda>s. \<exists>idx. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sz idx) (slot_of_untyped_inv ui) s \<and> (idx \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) and invs and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < length list)) s \<and> (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs and caps_no_overlap ptr' sz and pspace_no_overlap (up_aligned_area ptr' sz) and caps_overlap_reserved {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} and region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>idx. cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb) s) and K (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list))) s \<and> ((\<lambda>s. {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}) and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list))) s \<and> (\<forall>x\<in>set list. is_subject aag (fst x))\<rbrace>
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. ?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s proof (prove)
goal (7 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva) (set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr)
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. ((\<lambda>s. \<exists>idx. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sz idx) (slot_of_untyped_inv ui) s \<and> (idx \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) and invs and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < length list)) s \<and> (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs and caps_no_overlap ptr' sz and pspace_no_overlap (up_aligned_area ptr' sz) and caps_overlap_reserved {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} and region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>idx. cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb) s) and K (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list))) s \<and> ((\<lambda>s. {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}) and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list))) s \<and> (\<forall>x\<in>set list. is_subject aag (fst x))\<rbrace>
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. ?P'12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s proof (prove)
goal (6 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. ((\<lambda>s. \<exists>idx. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sz idx) (slot_of_untyped_inv ui) s \<and> (idx \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) and invs and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < length list)) s \<and> (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs and caps_no_overlap ptr' sz and pspace_no_overlap (up_aligned_area ptr' sz) and caps_overlap_reserved {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} and region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>idx. cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva rvb) s) and K (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list))) s \<and> ((\<lambda>s. {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}) and K (range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list))) s \<and> (\<forall>x\<in>set list. is_subject aag (fst x))\<rbrace>
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s proof (prove)
goal (6 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva\<rbrace> set_cap (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) cslot_ptr \<lbrace>\<lambda>rvb s. (\<exists>idx. cte_wp_at (\<lambda>c. c = UntypedCap dev (ptr' && ~~ mask sz) sz idx) cslot_ptr s \<and> (idx \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> invs s \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> invs s \<and> caps_no_overlap ptr' sz s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> caps_overlap_reserved {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} s \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>idx. cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()) s) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x))\<rbrace>
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> ?P''12 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva s\<rbrace>
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s proof (prove)
goal (5 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv) (get_cap cslot_ptr)
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv\<rbrace> get_cap cslot_ptr \<lbrace>\<lambda>rva s. (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>cap. free_index_of cap \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap cap \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits cap \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) cap = UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) cap) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>cap. free_index_of cap \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap cap \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits cap \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) cap = UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) cap) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of rva - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of rva) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of rva) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv rva) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x))\<rbrace>
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (whenE reset (reset_untyped_cap cslot_ptr))
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. ?P'11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s \<and> ?P''11 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s\<rbrace>, -
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> ?P'9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (3 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr True ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; reset\<rbrakk> \<Longrightarrow> reads_equiv_valid_g_inv (affects_equiv aag l) aag (?P219 cslot_ptr True ptr_base ptr' apiobject_type nat list) (reset_untyped_cap cslot_ptr)
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. K (is_subject aag (fst cslot_ptr)) s \<and> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))\<rbrace>, -
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> ?P219 cslot_ptr reset ptr_base ptr' apiobject_type nat list s) \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (2 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz\<rbrakk> \<Longrightarrow> \<lbrace>?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. K (is_subject aag (fst cslot_ptr)) s \<and> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))\<rbrace>, -
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ?P''9 cslot_ptr reset ptr_base ptr' apiobject_type nat list s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (2 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p)\<rbrakk> \<Longrightarrow> \<lbrace>?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>rv s. K (is_subject aag (fst cslot_ptr)) s \<and> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))\<rbrace>, -
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> (?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (4 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p)\<rbrakk> \<Longrightarrow> \<lbrace>?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> whenE reset (reset_untyped_cap cslot_ptr) \<lbrace>\<lambda>_. invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s\<rbrakk> \<Longrightarrow> K (is_subject aag (fst cslot_ptr)) s \<and> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> (?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (5 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); reset\<rbrakk> \<Longrightarrow> \<lbrace>?P'235 cslot_ptr reset ptr_base ptr' apiobject_type nat list\<rbrace> reset_untyped_cap cslot_ptr \<lbrace>\<lambda>_ s. invs s \<and> valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) s \<and> ct_active s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)\<rbrace>, -
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); ?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list s\<rbrakk> \<Longrightarrow> (if reset then \<lambda>s. True \<and> ?P'235 cslot_ptr reset ptr_base ptr' apiobject_type nat list s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s\<rbrakk> \<Longrightarrow> K (is_subject aag (fst cslot_ptr)) s \<and> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> (?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (6 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); reset; (invs and valid_untyped_inv_wcap (?ui247 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (Some (UntypedCap (?dev247 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (?ptr247 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (?sz247 cslot_ptr reset ptr_base ptr' apiobject_type nat list) 0)) and ct_active and pspace_no_overlap {?ptr247 cslot_ptr reset ptr_base ptr' apiobject_type nat list..?ptr247 cslot_ptr reset ptr_base ptr' apiobject_type nat list + 2 ^ ?sz247 cslot_ptr reset ptr_base ptr' apiobject_type nat list - 1}) s\<rbrakk> \<Longrightarrow> invs s \<and> valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) s \<and> ct_active s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); reset; invs s\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); ?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list s\<rbrakk> \<Longrightarrow> (if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (?ui247 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (Some (UntypedCap (?dev247 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (?ptr247 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (?sz247 cslot_ptr reset ptr_base ptr' apiobject_type nat list) (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. ?ui247 cslot_ptr reset ptr_base ptr' apiobject_type nat list = Retype cslot_ptr True ptr_basea ptr'a ty us slots (?dev247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s\<rbrakk> \<Longrightarrow> K (is_subject aag (fst cslot_ptr)) s \<and> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> (?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (5 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); reset; invs s\<rbrakk> \<Longrightarrow> True
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); ?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list s\<rbrakk> \<Longrightarrow> (if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s\<rbrakk> \<Longrightarrow> K (is_subject aag (fst cslot_ptr)) s \<and> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> (?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (4 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); ?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list s\<rbrakk> \<Longrightarrow> (if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s\<rbrakk> \<Longrightarrow> K (is_subject aag (fst cslot_ptr)) s \<and> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> (?P'225 cslot_ptr reset ptr_base ptr' apiobject_type nat list and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (3 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list rv s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); (invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) s\<rbrakk> \<Longrightarrow> K (is_subject aag (fst cslot_ptr)) s \<and> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst cslot_ptr))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (cslot_ptr = cslot_ptr \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> (cslot_ptr \<noteq> cslot_ptr \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) cslot_ptr s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) cslot_ptr s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) cslot_ptr and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} cslot_ptr s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap))) cslot_ptr s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) cslot_ptr s \<and> (?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap = cslot_ptr \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap \<noteq> cslot_ptr \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list rv cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ptr = ptr' && ~~ mask sz; ui = Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; valid_untyped_inv_wcap (Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx))) s; authorised_untyped_inv aag (Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev); \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p\<rbrakk> \<Longrightarrow> K (is_subject aag (fst (a, b))) s \<and> (\<forall>cap. cte_wp_at ((=) cap) (a, b) s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst (a, b)))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) (a, b) s \<and> ((a, b) = (a, b) \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> ((a, b) \<noteq> (a, b) \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) (a, b) s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) (a, b) s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) (a, b) s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) (a, b) and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} (a, b) s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 (a, b) reset ptr_base ptr' apiobject_type nat list () cap))) (a, b) s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) (a, b) s \<and> (?p201 (a, b) reset ptr_base ptr' apiobject_type nat list () cap = (a, b) \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 (a, b) reset ptr_base ptr' apiobject_type nat list () cap \<noteq> (a, b) \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 (a, b) reset ptr_base ptr' apiobject_type nat list () cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ptr = ptr' && ~~ mask sz; ui = Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; valid_untyped_inv_wcap (Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx))) s; authorised_untyped_inv aag (Retype (a, b) reset ptr_base ptr' apiobject_type nat list dev); \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset ptr_base ptr' apiobject_type nat list sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> K (is_subject aag (fst (a, b))) s \<and> (\<forall>cap. cte_wp_at ((=) cap) (a, b) s \<longrightarrow> (valid_global_objs and valid_arch_state and K (is_subject aag (fst (a, b)))) s \<and> (\<exists>x. (cte_wp_at (\<lambda>_. True) (a, b) s \<and> ((a, b) = (a, b) \<longrightarrow> UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) = UntypedCap dev (ptr' && ~~ mask sz) sz x) \<and> ((a, b) \<noteq> (a, b) \<longrightarrow> cte_wp_at (\<lambda>a. a = UntypedCap dev (ptr' && ~~ mask sz) sz x) (a, b) s)) \<and> (x \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s)) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) (a, b) s)) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> list \<noteq> [] \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> 0 < word_of_nat (length list) \<and> (invs s \<and> (\<exists>capa. free_index_of capa \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<and> is_untyped_cap capa \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base) \<le> 2 ^ cap_bits capa \<and> free_index_update (\<lambda>_. unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) capa = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)) \<and> cte_wp_at ((=) capa) (a, b) s)) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base)))) (a, b) and caps_no_overlap ptr' sz) s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> (invs s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr_base..ptr_base + 2 ^ bits_of cap - 1} \<and> usable_untyped_range (UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} (a, b) s \<and> cte_wp_at ((=) (UntypedCap dev ptr_base (bits_of cap) (?idx179 (a, b) reset ptr_base ptr' apiobject_type nat list () cap))) (a, b) s) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. cte_wp_at (\<lambda>_. True) (a, b) s \<and> (?p201 (a, b) reset ptr_base ptr' apiobject_type nat list () cap = (a, b) \<longrightarrow> UntypedCap dev (ptr' && ~~ mask sz) sz x = UntypedCap dev ptr_base (bits_of cap) (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - ptr_base))) \<and> (?p200 (a, b) reset ptr_base ptr' apiobject_type nat list () cap \<noteq> (a, b) \<longrightarrow> cte_wp_at ((=) (UntypedCap dev (ptr' && ~~ mask sz) sz x)) (?p199 (a, b) reset ptr_base ptr' apiobject_type nat list () cap) s)) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list) \<and> (\<forall>x\<in>set list. is_subject aag (fst x)))
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; authorised_untyped_inv aag (Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev); \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type\<rbrakk> \<Longrightarrow> is_subject aag a \<and> valid_global_objs s \<and> valid_arch_state s \<and> is_subject aag a \<and> (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> 0 < word_of_nat (length list) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> 2 ^ sz \<and> caps_no_overlap ptr' sz s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} (a, b) s \<and> ?idx179 (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list () (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) = (if reset then 0 else idx) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. (?p201 (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list () (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) = (a, b) \<longrightarrow> x = unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> (?p200 (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list () (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) \<noteq> (a, b) \<longrightarrow> caps_of_state s (?p199 (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list () (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx))) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz x))) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<forall>x\<in>set list. is_subject aag (fst x))
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; authorised_untyped_inv aag (Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev); \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> cap_range (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> is_subject aag a \<and> valid_global_objs s \<and> valid_arch_state s \<and> is_subject aag a \<and> (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> 0 < word_of_nat (length list) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> 2 ^ sz \<and> caps_no_overlap ptr' sz s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} (a, b) s \<and> ?idx179 (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list () (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) = (if reset then 0 else idx) \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. (?p201 (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list () (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) = (a, b) \<longrightarrow> x = unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> (?p200 (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list () (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) \<noteq> (a, b) \<longrightarrow> caps_of_state s (?p199 (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list () (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx))) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz x))) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<forall>x\<in>set list. is_subject aag (fst x))
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s
flex-flex pairs:
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p201 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p200 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva ()
\<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list. ?p199 cslot_ptr reset ptr_base ptr' apiobject_type nat list () \<equiv>\<^sup>? \<lambda>cslot_ptr reset ptr_base ptr' apiobject_type nat list rva. ?slot71 cslot_ptr reset ptr_base ptr' apiobject_type nat list () rva () proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; authorised_untyped_inv aag (Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev); \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> cap_range (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> is_subject aag a \<and> valid_global_objs s \<and> valid_arch_state s \<and> is_subject aag a \<and> (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> 0 < word_of_nat (length list) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> 2 ^ sz \<and> caps_no_overlap ptr' sz s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} (a, b) s \<and> True \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. ((a, b) = (a, b) \<longrightarrow> x = unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> (\<not> True \<longrightarrow> caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz x))) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<forall>x\<in>set list. is_subject aag (fst x))
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; authorised_untyped_inv aag (Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev); \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> cap_range (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> is_subject aag a \<and> invs s \<and> invs s \<and> is_subject aag a \<and> (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> 0 < word_of_nat (length list) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> 2 ^ sz \<and> caps_no_overlap ptr' sz s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {} \<and> descendants_range_in {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} (a, b) s \<and> True \<and> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<exists>x. ((a, b) = (a, b) \<longrightarrow> x = unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> (\<not> True \<longrightarrow> caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz x))) \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<forall>x\<in>set list. is_subject aag (fst x))
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)) = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> pspace_no_overlap (up_aligned_area ptr' sz) s \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz))) \<and> unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> 2 ^ sz \<and> (\<forall>x\<in>up_aligned_area ptr' sz. is_subject aag x) \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<and> (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)) \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap (up_aligned_area ptr' sz) s) \<and> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat (ptr' + (word_of_nat (length list) << obj_bits_api apiobject_type nat) - (ptr' && ~~ mask sz)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> region_in_kernel_window {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))) \<and> (\<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x) \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<and> (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)) \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s) \<and> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> (cap_refs_in_kernel_window s \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx))) \<and> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))) \<and> (\<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x) \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<and> (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)) \<le> unat (ptr' && mask sz) \<or> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s) \<and> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> (ptr' \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<longrightarrow> ptr' && ~~ mask sz \<le> ptr') \<and> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s \<and> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {} \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))) \<and> (\<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x) \<and> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (9 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> ptr' \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<longrightarrow> ptr' && ~~ mask sz \<le> ptr'
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 4. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))
 5. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 6. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 9. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (9 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> ptr' \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1 \<longrightarrow> ptr' && ~~ mask sz \<le> ptr'
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 4. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))
 5. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 6. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 9. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (8 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))
 4. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 5. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (9 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x; reset\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x; \<not> reset\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 4. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))
 5. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 6. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 9. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (8 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x; \<not> reset\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))
 4. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 5. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (8 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x; \<not> reset; \<not> reset \<longrightarrow> pspace_no_overlap (up_aligned_area ptr' sz) s\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))
 4. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 5. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 8. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (7 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<inter> global_refs s = {}
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 4. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (7 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 4. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 7. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (6 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat))
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 6. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (5 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (5 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>{ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> \<forall>x\<in>{ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1}. is_subject aag x
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (5 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> ptr' && ~~ mask sz \<le> ptr'
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 5. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (4 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (4 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> {ptr'..(ptr' && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 4. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; invoke_untyped_proofs s (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list sz (if reset then 0 else idx) dev; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (3 subgoals):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; reset \<longrightarrow> pspace_no_overlap {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; invs s; \<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); \<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz); ptr = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. ex_cte_cap_wp_to is_cnode_cap slot s \<and> caps_of_state s slot = Some NullCap \<and> real_cte_at slot s; apiobject_type \<noteq> ArchObject ASIDPoolObj; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; global_refs s \<inter> {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} = {}; 0 < word_of_nat (length list); is_subject aag a; \<forall>x\<in>set list. is_subject aag (fst x); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x; usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev (ptr' && ~~ mask sz) sz (unat ((ptr' && mask sz) + (word_of_nat (length list) << obj_bits_api apiobject_type nat)))) \<inter> {ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1} = {}
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 3. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (2 subgoals):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list e s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p); True\<rbrakk> \<Longrightarrow> True
 2. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (1 subgoal):
 1. \<And>cslot_ptr reset ptr_base ptr' apiobject_type nat list s. \<lbrakk>ui = Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev ptr_base sza idxa \<and> UntypedCap dev (ptr' && ~~ mask sz) sz idx = c) cslot_ptr s \<and> range_cover ptr' sza (obj_bits_api apiobject_type nat) (length list) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> reset \<and> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> (reset \<longrightarrow> descendants_of cslot_ptr (cdt s) = {}) \<and> (apiobject_type = CapTableObject \<longrightarrow> 0 < nat) \<and> (apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat) \<and> cslot_ptr \<notin> set list \<and> distinct list \<and> (\<forall>slot\<in>set list. cte_wp_at ((=) NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> apiobject_type \<noteq> ArchObject ASIDPoolObj \<and> list \<noteq> [] \<and> (dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type)) and only_timer_irq_inv irq st and ct_active and pas_refined aag and (\<lambda>y. authorised_untyped_inv aag (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev))) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cte_wp_at is_untyped_cap cslot_ptr s \<and> invs s \<and> ct_active s \<and> only_timer_irq_inv irq st s \<and> is_subject aag (fst cslot_ptr) \<and> descendants_of cslot_ptr (cdt s) = {}) \<and> ((if reset then \<lambda>s. True \<and> (invs and valid_untyped_inv_wcap (Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev) (Some (UntypedCap dev (ptr' && ~~ mask sz) sz (?idx247 cslot_ptr reset ptr_base ptr' apiobject_type nat list))) and ct_active and K (\<exists>ptr_basea ptr'a ty us slots. Retype cslot_ptr reset ptr_base ptr' apiobject_type nat list dev = Retype cslot_ptr True ptr_basea ptr'a ty us slots dev)) s else invs and valid_untyped_inv_wcap ui (Some (UntypedCap dev ptr sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s)) and K (authorised_untyped_inv aag ui \<and> (\<forall>p\<in>ptr_range ptr sz. is_subject aag p))) s proof (prove)
goal (1 subgoal):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; invs s; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); idx \<le> unat (ptr' && mask sz) \<or> reset \<and> ptr' = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; only_timer_irq_inv irq st s; ct_active s; pas_refined aag s; is_subject aag a; 0 < word_of_nat (length list); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x; apiobject_type \<noteq> ArchObject ASIDPoolObj; \<forall>x\<in>set list. is_subject aag (fst x)\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> idx = ?idx247 (a, b) True (ptr' && ~~ mask sz) ptr' apiobject_type nat list \<and> (?idx247 (a, b) True (ptr' && ~~ mask sz) ptr' apiobject_type nat list \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p)) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz) \<and> (\<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p)) proof (prove)
goal (1 subgoal):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; invs s; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); idx \<le> unat (ptr' && mask sz) \<or> reset \<and> ptr' = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; only_timer_irq_inv irq st s; ct_active s; pas_refined aag s; is_subject aag a; 0 < word_of_nat (length list); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x; apiobject_type \<noteq> ArchObject ASIDPoolObj; \<forall>x\<in>set list. is_subject aag (fst x)\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> True \<and> (idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p)) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz) \<and> (\<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p)) proof (prove)
goal (1 subgoal):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; invs s; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); idx \<le> unat (ptr' && mask sz) \<or> reset \<and> ptr' = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; only_timer_irq_inv irq st s; ct_active s; pas_refined aag s; is_subject aag a; 0 < word_of_nat (length list); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x; apiobject_type \<noteq> ArchObject ASIDPoolObj; \<forall>x\<in>set list. is_subject aag (fst x); aag_cap_auth aag (pasObjectAbs aag (fst (a, b))) (UntypedCap dev (ptr' && ~~ mask sz) sz idx)\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> True \<and> (idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p)) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz) \<and> (\<forall>p\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag p)) proof (prove)
goal (1 subgoal):
 1. \<And>a b reset ptr' apiobject_type nat list s. \<lbrakk>ui = Retype (a, b) reset (ptr' && ~~ mask sz) ptr' apiobject_type nat list dev; ptr = ptr' && ~~ mask sz; invs s; caps_of_state s (a, b) = Some (UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api apiobject_type nat) (length list); idx \<le> unat (ptr' && mask sz) \<or> reset \<and> ptr' = ptr' && ~~ mask sz; reset \<longrightarrow> descendants_of (a, b) (cdt s) = {}; apiobject_type = CapTableObject \<longrightarrow> 0 < nat; apiobject_type = Untyped \<longrightarrow> untyped_min_bits \<le> nat; (a, b) \<notin> set list; distinct list; \<forall>slot\<in>set list. caps_of_state s slot = Some NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; list \<noteq> []; dev \<longrightarrow> apiobject_type = Untyped \<or> is_frame_type apiobject_type; only_timer_irq_inv irq st s; ct_active s; pas_refined aag s; is_subject aag a; 0 < word_of_nat (length list); \<forall>x\<in>set (retype_addrs ptr' apiobject_type (length list) nat). is_subject aag x; \<forall>x\<in>{ptr'..ptr' + word_of_nat (length list) * 2 ^ obj_bits_api apiobject_type nat - 1}. is_subject aag x; apiobject_type \<noteq> ArchObject ASIDPoolObj; \<forall>x\<in>set list. is_subject aag (fst x); (\<forall>x\<in>ptr_range (ptr' && ~~ mask sz) sz. is_subject aag x) \<and> cap_links_asid_slot aag (pasSubject aag) (UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> cap_links_irq aag (pasSubject aag) (UntypedCap dev (ptr' && ~~ mask sz) sz idx)\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr' && mask sz)) proof (prove)
goal:
No subgoals!