theory Untyped_R

lemma resetUntypedCap_invs_etc:
  "\<lbrace>invs' and valid_untyped_inv_wcap' ui
      (Some (UntypedCap dev ptr sz idx))
         and ct_active'
         and K (\<exists>ptr_base ptr' ty us slots. ui = Retype slot True ptr_base ptr' ty us slots dev)\<rbrace>
    resetUntypedCap slot
  \<lbrace>\<lambda>_. invs' and valid_untyped_inv_wcap' ui (Some (UntypedCap dev ptr sz 0))
      and ct_active'
      and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>"
  (is "\<lbrace>invs' and valid_untyped_inv_wcap' ?ui (Some ?cap) and ct_active' and ?asm\<rbrace>
    ?f \<lbrace>\<lambda>_. invs' and ?vu2 and ct_active' and ?psp\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>") apply (simp add: resetUntypedCap_def getSlotCap_def
                   liftE_bind_return_bindE_returnOk bindE_assoc) apply (rule hoare_vcg_seqE[rotated]) apply simp apply (rule getCTE_sp) apply (rule hoare_name_pre_stateE) apply (clarsimp split del: if_split) apply (subgoal_tac "capAligned ?cap") prefer 2 apply (frule cte_wp_at_valid_objs_valid_cap', clarsimp+) apply (clarsimp simp: cte_wp_at_ctes_of capAligned_def valid_cap_simps') apply (cases "idx = 0") apply (clarsimp simp: cte_wp_at_ctes_of unlessE_def split del: if_split) apply wp apply (clarsimp simp: valid_cap_simps' capAligned_def) apply (rule cte_wp_at_pspace_no_overlapI'[where cref=slot],
       (simp_all add: cte_wp_at_ctes_of)+)[1] apply (clarsimp simp: unlessE_def cte_wp_at_ctes_of
             split del: if_split) apply (rule_tac B="\<lambda>_. invs' and valid_untyped_inv_wcap' ?ui (Some ?cap)
        and ct_active' and ?psp" in hoare_vcg_seqE[rotated]) apply clarsimp apply (rule hoare_pre) apply (simp add: sch_act_simple_def) apply (wps ) apply (wp deleteObject_no_overlap[where idx=idx]
              deleteObjects_invs'[where idx=idx and p=slot]
              hoare_vcg_ex_lift hoare_vcg_const_Ball_lift
              deleteObjects_cte_wp_at'[where idx=idx]
              deleteObjects_descendants[where p=slot]
              deleteObjects_nosch
              deleteObjects_ct_active'[where idx=idx and cref=slot]
              deleteObjects_ex_cte_cap_wp_to'[where p=slot]) apply (clarsimp simp: cte_wp_at_ctes_of descendants_range'_def2
                         empty_descendants_range_in'
                         capAligned_def sch_act_simple_def) apply (strengthen refl) apply (frule ctes_of_valid[OF ctes_of_cte_wpD], clarsimp+) apply (frule if_unsafe_then_capD'[OF ctes_of_cte_wpD], clarsimp+) apply (erule rev_mp[where P="Ball S f" for S f]
                rev_mp[where P="ex_cte_cap_wp_to' P p s" for P p s])+ apply (strengthen descendants_range_ex_cte'[rotated, OF _ order_refl, mk_strg D _ E]) apply (clarsimp simp: isCap_simps empty_descendants_range_in') apply auto[1] apply (cases "dev \<or> sz < resetChunkBits") apply (simp add: pred_conj_def unless_def) apply (rule hoare_pre) apply (strengthen exI[where x=sz]) apply (wp updateFreeIndex_clear_invs'
              hoare_vcg_ex_lift
              hoare_vcg_const_Ball_lift
              updateFreeIndex_descendants_of2
              sch_act_simple_lift
              pspace_no_overlap'_lift
              doMachineOp_psp_no_overlap
              updateFreeIndex_ctes_of
              updateFreeIndex_cte_wp_at
            | simp | wps | wp (once) ex_cte_cap_to'_pres)+ apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps
                         modify_map_def) apply auto[1] apply simp apply (rule hoare_pre, rule hoare_post_impErr,
    rule_tac P="\<lambda>i. invs' and ?psp and ct_active' and valid_untyped_inv_wcap' ?ui
        (Some (UntypedCap dev ptr sz (if i = 0 then idx
            else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)))"
      and E="\<lambda>_. invs'"
      in mapME_x_validE_nth) apply (rule hoare_pre) apply simp apply (wp preemptionPoint_invs
                updateFreeIndex_clear_invs'
                hoare_vcg_ex_lift
                updateFreeIndex_descendants_of2
                updateFreeIndex_ctes_of
                updateFreeIndex_cte_wp_at
                doMachineOp_psp_no_overlap
                hoare_vcg_ex_lift hoare_vcg_const_Ball_lift
                pspace_no_overlap'_lift[OF preemptionPoint_inv]
                pspace_no_overlap'_lift
                updateFreeIndex_ct_in_state[unfolded ct_in_state'_def]
              | strengthen invs_pspace_aligned' invs_pspace_distinct'
              | simp add: ct_in_state'_def
                          sch_act_simple_def
              | rule hoare_vcg_conj_lift_R
              | wp (once) preemptionPoint_inv
              | wps
              | wp (once) ex_cte_cap_to'_pres)+ apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps
                           conj_comms) apply (subgoal_tac "getFreeIndex ptr
            (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)
          = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) *
               2 ^ resetChunkBits") apply clarsimp apply (frule ctes_of_valid[OF ctes_of_cte_wpD], clarsimp+) apply (subgoal_tac "resetChunkBits < word_bits \<and> sz < word_bits") apply (strengthen is_aligned_weaken[OF is_aligned_mult_triv2]) apply (subst nat_less_power_trans2[THEN order_less_imp_le]) apply (clarsimp simp add: upto_enum_step_def getFreeRef_def) apply (rule less_imp_diff_less) apply (simp add: unat_div td_gal_lt[symmetric] power_add[symmetric]) apply (cases "idx = 0") apply (simp add: gt0_iff_gem1[symmetric, folded word_neq_0_conv]) apply (simp add: valid_cap_simps') apply (subst unat_minus_one) apply (clarsimp simp: valid_cap_simps') apply (drule of_nat32_0) apply (erule order_le_less_trans, simp) apply simp apply (clarsimp simp: unat_of_nat valid_cap_simps') apply (erule order_less_le_trans[rotated], simp) apply simp apply (auto simp: Kernel_Config.resetChunkBits_def minUntypedSizeBits_def)[1] apply (simp add: valid_cap_simps' Kernel_Config.resetChunkBits_def capAligned_def) apply (simp add: nth_rev) apply (simp add: upto_enum_step_def upto_enum_word getFreeIndex_def
                      getFreeRef_def
                 del: upt.simps) apply (intro conjI impI, simp_all)[1] apply (subgoal_tac "resetChunkBits < word_bits") apply (rule word_unat.Abs_eqD[OF _ word_unat.Rep]) apply (simp add: word_of_nat_plus Abs_fnat_hom_mult[symmetric]) apply (simp only: unats_def word_bits_def[symmetric]) apply (clarsimp simp: unat_div nat_mult_power_less_eq) apply (rule less_imp_diff_less) apply (simp add: td_gal_lt[symmetric] power_add[symmetric]) apply (simp only: unat_lt2p word_bits_def) apply (simp add: Kernel_Config.resetChunkBits_def word_bits_def) apply (clarsimp simp: cte_wp_at_ctes_of getFreeRef_def
                          upto_enum_step_def upto_enum_word) apply (frule cte_wp_at_valid_objs_valid_cap'[OF ctes_of_cte_wpD], clarsimp+) apply (clarsimp simp: valid_cap_simps' capAligned_def) apply (simp add: reset_ineq_eq_idx_0) apply simp apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and K (\<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr' ty us slots dev)\<rbrace> resetUntypedCap slot \<lbrace>\<lambda>_. invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz 0)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and (\<lambda>y. \<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr' ty us slots dev)\<rbrace> doE x <- liftE (getCTE slot);
unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE)
odE \<lbrace>\<lambda>_. invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz 0)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and (\<lambda>y. \<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr' ty us slots dev)\<rbrace> liftE (getCTE slot) \<lbrace>?B\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x. \<lbrace>?B x\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz 0)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and (\<lambda>y. \<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr' ty us slots dev)\<rbrace> getCTE slot \<lbrace>?B\<rbrace>
 2. \<And>x. \<lbrace>?B x\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz 0)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrace>cte_wp_at' (\<lambda>c. c = x) slot and (invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and (\<lambda>y. \<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr' ty us slots dev))\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz 0)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x s. (cte_wp_at' (\<lambda>c. c = x) slot and (invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and (\<lambda>y. \<exists>ptr_base ptr' ty us slots. ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr' ty us slots dev))) s \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz 0)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> capAligned (capability.UntypedCap dev ptr sz idx) proof (prove)
goal (2 subgoals):
 1. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> capAligned (capability.UntypedCap dev ptr sz idx)
 2. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; valid_cap' (cteCap x) s\<rbrakk> \<Longrightarrow> capAligned (capability.UntypedCap dev ptr sz idx)
 2. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); idx = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz 0); idx = 0; cteCap x = capability.UntypedCap dev ptr sz 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> returnOk () \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz 0); idx = 0; cteCap x = capability.UntypedCap dev ptr sz 0; s = sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 2. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x ty us slots sa. \<lbrakk>ctes_of sa slot = Some x; invs' sa; ct_active' sa; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); descendants_of' slot (ctes_of sa) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; sch_act_simple sa; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; idx = 0; cteCap x = capability.UntypedCap dev ptr sz 0; is_aligned ptr sz; sz < word_bits\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz sa
 2. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x s ptr_base ty us slots sza idxa. \<lbrakk>cte_wp_at' (\<lambda>c. c = x) slot s; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr_base ptr_base ty us slots dev; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s; range_cover ptr_base sza (APIType_capBits ty us) (length slots); ptr_base && ~~ mask sza = ptr_base; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); idx \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> unlessE (capFreeIndex (cteCap x) = 0) (doE y <- liftE (deleteObjects (capPtr (cteCap x)) (capBlockSize (cteCap x)));
if capIsDevice (cteCap x) \<or> capBlockSize (cteCap x) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) slot s) \<and> range_cover ptr_base sza (APIType_capBits ty us) (length slots) \<and> ptr_base && ~~ mask sza = ptr_base \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> doE y <- liftE (deleteObjects ptr sz);
if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE)
odE \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftE (deleteObjects ptr sz) \<lbrace>\<lambda>_. invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q72 x s ty us slots\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>
 2. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; s = sa\<rbrakk> \<Longrightarrow> ?Q72 x s ty us slots sa
 3. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q72 x s ty us slots\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> (ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>
 2. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; s = sa\<rbrakk> \<Longrightarrow> ?Q72 x s ty us slots sa
 3. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x s ty us slots prev_s. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?P75 x s ty us slots prev_s\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv s'. invs' s' \<and> (\<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot s') \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s') = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s') \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s') \<and> (ksSchedulerAction s' = ResumeCurrentThread \<or> ksSchedulerAction s' = ChooseNewThread)) \<and> ct_active' s' \<and> pspace_no_overlap' ptr sz s'\<rbrace>
 2. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; s = sa\<rbrakk> \<Longrightarrow> ?P75 x s ty us slots sa sa
 3. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; s = sa\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d83 x s ty us slots sa) ptr sz idx) slot and invs' and ct_active' and sch_act_simple and (\<lambda>sb. descendants_range' (capability.UntypedCap (?d83 x s ty us slots sa) ptr sz idx) slot (ctes_of sb)) and K (sz < word_bits \<and> is_aligned ptr sz)) sa \<and> (\<exists>xa. (\<exists>xb. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr xa xb \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot sa \<and> slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (capability.UntypedCap (?d88 x s ty us slots sa xa xb) ptr sz idx) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d90 x s ty us slots sa xa) ptr sz (?idx90 x s ty us slots sa xa)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>sb. descendants_range' (capability.UntypedCap (?d90 x s ty us slots sa xa) ptr sz (?idx90 x s ty us slots sa xa)) slot (ctes_of sb)) and (\<lambda>s. range_cover ptr xa (APIType_capBits ty us) (length slots)) and K (sz < word_bits \<and> is_aligned ptr sz)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d92 x s ty us slots sa xa) ptr sz (?idx92 x s ty us slots sa xa)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>sb. descendants_range' (capability.UntypedCap (?d92 x s ty us slots sa xa) ptr sz (?idx92 x s ty us slots sa xa)) slot (ctes_of sb)) and (\<lambda>s. ptr && ~~ mask xa = ptr) and K (sz < word_bits \<and> is_aligned ptr sz)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d94 x s ty us slots sa xa) ptr sz (?idx94 x s ty us slots sa xa)) slot and invs' and ct_active' and sch_act_simple and (\<lambda>sb. descendants_range' (capability.UntypedCap (?d94 x s ty us slots sa xa) ptr sz (?idx94 x s ty us slots sa xa)) slot (ctes_of sb)) and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) sa \<and> (\<forall>xb\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) xb sa \<and> xb \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (capability.UntypedCap (?d97 x s ty us slots sa xa xb) ptr sz idx) sa \<and> valid_pspace' sa) \<and> (\<forall>x\<in>set slots. (invs' and ex_cte_cap_wp_to' (\<lambda>_. True) x and (\<lambda>s. descendants_of' slot (ctes_of s) = {}) and cte_wp_at' (\<lambda>cte. \<exists>idx d. cteCap cte = capability.UntypedCap d ptr sz idx) slot) sa) \<and> (ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread)) \<and> (invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d103 x s ty us slots sa) ptr sz idx) slot and (\<lambda>sb. descendants_range' (capability.UntypedCap (?d103 x s ty us slots sa) ptr sz idx) slot (ctes_of sb)) and K (sz < word_bits \<and> is_aligned ptr sz)) sa \<and> (valid_cap' (capability.UntypedCap (?d104 x s ty us slots sa) ptr sz idx) and valid_pspace') sa
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x ty us slots sa. \<lbrakk>ctes_of sa slot = Some x; invs' sa; ct_active' sa; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); descendants_of' slot (ctes_of sa) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; is_aligned ptr sz; sz < word_bits\<rbrakk> \<Longrightarrow> dev = ?d83 x sa ty us slots sa \<and> (ptr \<le> slot \<longrightarrow> \<not> slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d88 x sa ty us slots sa sz idx) ptr sz idx) sa \<and> valid_pspace' sa \<and> dev = ?d90 x sa ty us slots sa sz \<and> idx = ?idx90 x sa ty us slots sa sz \<and> dev = ?d92 x sa ty us slots sa sz \<and> idx = ?idx92 x sa ty us slots sa sz \<and> dev = ?d94 x sa ty us slots sa sz \<and> idx = ?idx94 x sa ty us slots sa sz \<and> (\<forall>xa\<in>set slots. (ptr \<le> xa \<longrightarrow> \<not> xa \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d97 x sa ty us slots sa sz xa) ptr sz idx) sa \<and> valid_pspace' sa) \<and> dev = ?d103 x sa ty us slots sa \<and> valid_cap' (capability.UntypedCap (?d104 x sa ty us slots sa) ptr sz idx) sa \<and> valid_pspace' sa
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x ty us slots sa. \<lbrakk>ctes_of sa slot = Some x; invs' sa; ct_active' sa; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); descendants_of' slot (ctes_of sa) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; is_aligned ptr sz; sz < word_bits\<rbrakk> \<Longrightarrow> True \<and> (ptr \<le> slot \<longrightarrow> \<not> slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d88 x sa ty us slots sa sz idx) ptr sz idx) sa \<and> valid_pspace' sa \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> (\<forall>xa\<in>set slots. (ptr \<le> xa \<longrightarrow> \<not> xa \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d97 x sa ty us slots sa sz xa) ptr sz idx) sa \<and> valid_pspace' sa) \<and> True \<and> valid_cap' (capability.UntypedCap (?d104 x sa ty us slots sa) ptr sz idx) sa \<and> valid_pspace' sa
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x ty us slots sa. \<lbrakk>ctes_of sa slot = Some x; invs' sa; ct_active' sa; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); descendants_of' slot (ctes_of sa) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; is_aligned ptr sz; sz < word_bits; valid_cap' (capability.UntypedCap dev ptr sz idx) sa\<rbrakk> \<Longrightarrow> (ptr \<le> slot \<longrightarrow> \<not> slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d88 x sa ty us slots sa sz idx) ptr sz idx) sa \<and> valid_pspace' sa \<and> (\<forall>xa\<in>set slots. (ptr \<le> xa \<longrightarrow> \<not> xa \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d97 x sa ty us slots sa sz xa) ptr sz idx) sa \<and> valid_pspace' sa) \<and> valid_cap' (capability.UntypedCap (?d104 x sa ty us slots sa) ptr sz idx) sa \<and> valid_pspace' sa
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x ty us slots sa. \<lbrakk>ctes_of sa slot = Some x; invs' sa; ct_active' sa; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); descendants_of' slot (ctes_of sa) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; is_aligned ptr sz; sz < word_bits; valid_cap' (capability.UntypedCap dev ptr sz idx) sa; ex_cte_cap_wp_to' (\<lambda>_. True) slot sa\<rbrakk> \<Longrightarrow> (ptr \<le> slot \<longrightarrow> \<not> slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d88 x sa ty us slots sa sz idx) ptr sz idx) sa \<and> valid_pspace' sa \<and> (\<forall>xa\<in>set slots. (ptr \<le> xa \<longrightarrow> \<not> xa \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d97 x sa ty us slots sa sz xa) ptr sz idx) sa \<and> valid_pspace' sa) \<and> valid_cap' (capability.UntypedCap (?d104 x sa ty us slots sa) ptr sz idx) sa \<and> valid_pspace' sa
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x ty us slots sa. \<lbrakk>ctes_of sa slot = Some x; invs' sa; ct_active' sa; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); descendants_of' slot (ctes_of sa) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; is_aligned ptr sz; sz < word_bits; valid_cap' (capability.UntypedCap dev ptr sz idx) sa\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) slot sa \<longrightarrow> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa) \<longrightarrow> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap) \<longrightarrow> (ptr \<le> slot \<longrightarrow> \<not> slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d88 x sa ty us slots sa sz idx) ptr sz idx) sa \<and> valid_pspace' sa \<and> (\<forall>xa\<in>set slots. (ptr \<le> xa \<longrightarrow> \<not> xa \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d97 x sa ty us slots sa sz xa) ptr sz idx) sa \<and> valid_pspace' sa) \<and> valid_cap' (capability.UntypedCap (?d104 x sa ty us slots sa) ptr sz idx) sa \<and> valid_pspace' sa
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x ty us slots sa. \<lbrakk>ctes_of sa slot = Some x; invs' sa; ct_active' sa; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); descendants_of' slot (ctes_of sa) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; is_aligned ptr sz; sz < word_bits; valid_cap' (capability.UntypedCap dev ptr sz idx) sa\<rbrakk> \<Longrightarrow> (invs' sa \<longrightarrow> isUntypedCap (cteCap x) \<longrightarrow> descendants_range_in' (capRange (cteCap x)) slot (ctes_of sa) \<longrightarrow> slot \<notin> capRange (cteCap x)) \<longrightarrow> (\<forall>xa\<in>set slots. invs' sa \<longrightarrow> isUntypedCap (cteCap x) \<longrightarrow> descendants_range_in' (capRange (cteCap x)) slot (ctes_of sa) \<longrightarrow> xa \<notin> capRange (cteCap x)) \<longrightarrow> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap) \<longrightarrow> (ptr \<le> slot \<longrightarrow> \<not> slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d88 x sa ty us slots sa sz idx) ptr sz idx) sa \<and> valid_pspace' sa \<and> (\<forall>xa\<in>set slots. (ptr \<le> xa \<longrightarrow> \<not> xa \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap (?d97 x sa ty us slots sa sz xa) ptr sz idx) sa \<and> valid_pspace' sa) \<and> valid_cap' (capability.UntypedCap (?d104 x sa ty us slots sa) ptr sz idx) sa \<and> valid_pspace' sa
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x ty us slots sa. \<lbrakk>ctes_of sa slot = Some x; invs' sa; ct_active' sa; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); descendants_of' slot (ctes_of sa) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; is_aligned ptr sz; sz < word_bits; valid_cap' (capability.UntypedCap dev ptr sz idx) sa; ptr \<le> slot \<longrightarrow> \<not> slot \<le> ptr + 2 ^ sz - 1; \<forall>x\<in>set slots. ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ sz - 1; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap (?d88 x sa ty us slots sa sz idx) ptr sz idx) sa \<and> valid_pspace' sa \<and> (\<forall>xa\<in>set slots. valid_cap' (capability.UntypedCap (?d97 x sa ty us slots sa sz xa) ptr sz idx) sa \<and> valid_pspace' sa) \<and> valid_cap' (capability.UntypedCap (?d104 x sa ty us slots sa) ptr sz idx) sa \<and> valid_pspace' sa
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; dev \<or> sz < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; dev \<or> sz < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. invs' x \<and> (\<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot x) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of x) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot x) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot x) \<and> sch_act_simple x) \<and> ct_active' x \<and> pspace_no_overlap' ptr sz x\<rbrace> do y <- when (\<not> dev) (doMachineOp (clearMemory ptr (shiftL (Suc 0) sz)));
updateFreeIndex slot 0
od \<lbrace>\<lambda>_ x. invs' x \<and> (\<exists>sza. (\<exists>idx cte. ctes_of x slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of x) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of x slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot x) \<and> sch_act_simple x) \<and> ct_active' x \<and> pspace_no_overlap' ptr sz x\<rbrace>
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; dev \<or> sz < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q868 x s ty us slots\<rbrace> do y <- when (\<not> dev) (doMachineOp (clearMemory ptr (shiftL (Suc 0) sz)));
updateFreeIndex slot 0
od \<lbrace>\<lambda>_ x. invs' x \<and> (\<exists>sza. (\<exists>idx cte. ctes_of x slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of x) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of x slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot x) \<and> sch_act_simple x) \<and> ct_active' x \<and> pspace_no_overlap' ptr sz x\<rbrace>
 2. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; dev \<or> sz < resetChunkBits; invs' sa \<and> (\<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot sa) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot sa) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa) \<and> sch_act_simple sa) \<and> ct_active' sa \<and> pspace_no_overlap' ptr sz sa\<rbrakk> \<Longrightarrow> ?Q868 x s ty us slots sa
 3. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; dev \<or> sz < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q868 x s ty us slots\<rbrace> do y <- when (\<not> dev) (doMachineOp (clearMemory ptr (shiftL (Suc 0) sz)));
updateFreeIndex slot 0
od \<lbrace>\<lambda>r sa. invs' sa \<and> ((\<exists>idx cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sz idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sz (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sz = ptr \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa) \<and> sch_act_simple sa) \<and> ct_active' sa \<and> pspace_no_overlap' ptr sz sa\<rbrace>
 2. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; dev \<or> sz < resetChunkBits; invs' sa \<and> (\<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot sa) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot sa) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa) \<and> sch_act_simple sa) \<and> ct_active' sa \<and> pspace_no_overlap' ptr sz sa\<rbrakk> \<Longrightarrow> ?Q868 x s ty us slots sa
 3. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; dev \<or> sz < resetChunkBits; invs' sa \<and> (\<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) slot sa) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot sa) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa) \<and> sch_act_simple sa) \<and> ct_active' sa \<and> pspace_no_overlap' ptr sz sa\<rbrakk> \<Longrightarrow> (\<not> dev \<longrightarrow> pspace_aligned' sa \<and> pspace_distinct' sa \<and> (\<exists>x xa. pspace_no_overlap' x xa sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xa) slot sa) \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<exists>x xa. modify_map (ctes_of sa) slot (cteCap_update (capFreeIndex_update (\<lambda>_. 0))) slot = Some xa \<and> cteCap xa = capability.UntypedCap False ptr sz x \<and> capability.UntypedCap False ptr sz 0 = cteCap xa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot sa \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<forall>x\<in>set slots. \<exists>xa. modify_map (ctes_of sa) slot (cteCap_update (capFreeIndex_update (\<lambda>_. 0))) x = Some xa \<and> cteCap xa = capability.NullCap) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot sa \<and> ex_cte_cap_wp_to' (\<lambda>_. True) x sa) \<and> sch_act_simple sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> (dev \<longrightarrow> (\<exists>ptr sz. pspace_no_overlap' ptr sz sa \<and> cte_wp_at' ((\<lambda>c. isUntypedCap c \<and> capPtr c = ptr \<and> capBlockSize c = sz) \<circ> cteCap) slot sa) \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<exists>x xa. modify_map (ctes_of sa) slot (cteCap_update (capFreeIndex_update (\<lambda>_. 0))) slot = Some xa \<and> cteCap xa = capability.UntypedCap True ptr sz x \<and> capability.UntypedCap True ptr sz 0 = cteCap xa) \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) slot sa \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<forall>x\<in>set slots. \<exists>xa. modify_map (ctes_of sa) slot (cteCap_update (capFreeIndex_update (\<lambda>_. 0))) x = Some xa \<and> cteCap xa = capability.NullCap) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isUntypedCap \<circ> cteCap) slot sa \<and> ex_cte_cap_wp_to' (\<lambda>_. True) x sa) \<and> sch_act_simple sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa)
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; dev \<or> sz < resetChunkBits; invs' sa; ct_active' sa; pspace_no_overlap' ptr sz sa; range_cover ptr sz (APIType_capBits ty us) (length slots); ctes_of sa slot = Some cte; ptr && ~~ mask sz = ptr; cteCap cte = capability.UntypedCap dev ptr sz idx; descendants_of' slot (ctes_of sa) = {}; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; sch_act_simple sa\<rbrakk> \<Longrightarrow> (\<not> dev \<longrightarrow> pspace_aligned' sa \<and> pspace_distinct' sa \<and> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> (dev \<longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> pspace_aligned' sa \<and> pspace_distinct' sa)
 2. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x s ty us slots xa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots dev; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ty; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap dev ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap dev ptr sz idx; \<not> (dev \<or> sz < resetChunkBits)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz idx)) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (cteCap x)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (cteCap x)))) (1 `~shiftL~` capBlockSize (cteCap x));
updateFreeIndex slot 0
od else forME_x (reverse [capPtr (cteCap x) , capPtr (cteCap x) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (cteCap x)) (capFreeIndex (cteCap x)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex slot (getFreeIndex (capPtr (cteCap x)) addr);
preemptionPoint
odE) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap dev ptr sza idx \<and> capability.UntypedCap dev ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x s ty us slots. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace> mapME_x (\<lambda>addr. doE y <- liftE (doMachineOp (clearMemory addr (shiftL (Suc 0) resetChunkBits)));
y <- liftE (updateFreeIndex slot (getFreeIndex ptr addr));
preemptionPoint
odE) (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) \<lbrace>\<lambda>_. invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>x s ty us slots i. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; i < length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)))\<rbrace> doE y <- liftE (doMachineOp (clearMemory (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) (shiftL (Suc 0) resetChunkBits)));
y <- liftE (updateFreeIndex slot (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)));
preemptionPoint
odE \<lbrace>\<lambda>y. invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if Suc i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits)))\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 3. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 4. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; i < length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])\<rbrakk> \<Longrightarrow> \<lbrace>?Q1396 x s ty us slots i\<rbrace> doE y <- liftE (doMachineOp (clearMemory (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) (shiftL (Suc 0) resetChunkBits)));
y <- liftE (updateFreeIndex slot (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)));
preemptionPoint
odE \<lbrace>\<lambda>y. invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if Suc i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits)))\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x s ty us slots i sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; i < length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]); (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> ?Q1396 x s ty us slots i sa
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]\<rbrakk> \<Longrightarrow> \<lbrace>?Q1396 x s ty us slots i\<rbrace> doE y <- liftE (doMachineOp (clearMemory (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) (shiftL (Suc 0) resetChunkBits)));
y <- liftE (updateFreeIndex slot (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)));
preemptionPoint
odE \<lbrace>\<lambda>y. invs' and pspace_no_overlap' ptr sz and ct_active' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz ((length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits) = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s)\<rbrace>, \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>x s ty us slots i sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; i < length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]); (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> ?Q1396 x s ty us slots i sa
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>x s ty us slots i sa. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; invs' sa \<and> pspace_no_overlap' ptr sz sa \<and> st_tcb_at' active' (ksCurThread sa) sa \<and> (\<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits) = cteCap cte) slot sa) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot sa) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa) \<and> (ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread))\<rbrakk> \<Longrightarrow> (\<exists>x xa. pspace_no_overlap' x xa sa \<and> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) \<le> 2 ^ xa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xa) slot sa) \<and> is_aligned (word_of_nat (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<exists>x xa. pspace_no_overlap' x xa sa \<and> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) \<le> 2 ^ xa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xa) slot sa) \<and> is_aligned (word_of_nat (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<exists>x xa. pspace_no_overlap' x xa sa \<and> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) \<le> 2 ^ xa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xa) slot sa) \<and> is_aligned (word_of_nat (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<exists>x xa. pspace_no_overlap' x xa sa \<and> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) \<le> 2 ^ xa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xa) slot sa) \<and> is_aligned (word_of_nat (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<exists>x xa. pspace_no_overlap' x xa sa \<and> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) \<le> 2 ^ xa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xa) slot sa) \<and> is_aligned (word_of_nat (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<exists>x xa. pspace_no_overlap' x xa sa \<and> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) \<le> 2 ^ xa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xa) slot sa) \<and> is_aligned (word_of_nat (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i))) minUntypedSizeBits \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<exists>x. (\<exists>xa. cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)) (cteCap c) = capability.UntypedCap False ptr x xa \<and> capability.UntypedCap False ptr sz ((length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits) = capFreeIndex_update (\<lambda>_. getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)) (cteCap c)) slot sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot sa \<and> range_cover ptr x (APIType_capBits ty us) (length slots) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot sa \<and> ptr && ~~ mask x = ptr \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot sa \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<forall>x\<in>set slots. (x = slot \<longrightarrow> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)) (cteCap c) = capability.NullCap) slot sa) \<and> (x \<noteq> slot \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x sa)) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot sa \<and> ex_cte_cap_wp_to' (\<lambda>_. True) x sa) \<and> (ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot sa \<and> descendants_of' slot (ctes_of sa) = {} \<and> (\<forall>x\<in>set slots. (x = slot \<longrightarrow> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)) (cteCap c) = capability.NullCap) slot sa) \<and> (x \<noteq> slot \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x sa)) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) slot sa \<and> ex_cte_cap_wp_to' (\<lambda>_. True) x sa) \<and> (ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread))
 2. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 3. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 4. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> is_aligned (word_of_nat (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i))) minUntypedSizeBits \<and> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) \<le> 2 ^ sz \<and> (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits = getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)
 2. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 3. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 4. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> is_aligned (word_of_nat (getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i))) minUntypedSizeBits \<and> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) \<le> 2 ^ sz \<and> (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits = getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i)
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> is_aligned ((word_of_nat (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) - (1 + word_of_nat i)) * 2 ^ resetChunkBits) minUntypedSizeBits \<and> (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits \<le> 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> is_aligned ((word_of_nat (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) - (1 + word_of_nat i)) * 2 ^ resetChunkBits) minUntypedSizeBits \<and> (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits \<le> 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (6 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> is_aligned ((word_of_nat (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) - (1 + word_of_nat i)) * 2 ^ resetChunkBits) minUntypedSizeBits \<and> (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits \<le> 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 4. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 5. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 6. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (6 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits \<le> 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 4. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 5. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 6. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (8 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i < 2 ^ (sz - resetChunkBits)
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 6. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 7. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 8. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (8 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i < 2 ^ (sz - resetChunkBits)
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 6. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 7. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 8. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (8 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) < 2 ^ (sz - resetChunkBits)
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 6. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 7. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 8. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (8 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> unat (word_of_nat idx - 1) < 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 6. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 7. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 8. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (9 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; idx = 0\<rbrakk> \<Longrightarrow> unat (word_of_nat idx - 1) < 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; idx \<noteq> 0\<rbrakk> \<Longrightarrow> unat (word_of_nat idx - 1) < 2 ^ sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 6. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 7. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 8. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 9. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (8 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; idx \<noteq> 0\<rbrakk> \<Longrightarrow> unat (word_of_nat idx - 1) < 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 6. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 7. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 8. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (8 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_untyped' False ptr sz idx s \<and> ptr \<noteq> 0 \<and> minUntypedSizeBits \<le> sz \<and> sz \<le> maxUntypedSizeBits \<and> idx \<le> 2 ^ sz \<and> is_aligned (word_of_nat idx) minUntypedSizeBits; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; 0 < idx\<rbrakk> \<Longrightarrow> unat (word_of_nat idx - 1) < 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 6. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 7. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 8. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (9 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_untyped' False ptr sz idx s \<and> ptr \<noteq> 0 \<and> minUntypedSizeBits \<le> sz \<and> sz \<le> maxUntypedSizeBits \<and> idx \<le> 2 ^ sz \<and> is_aligned (word_of_nat idx) minUntypedSizeBits; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; 0 < idx\<rbrakk> \<Longrightarrow> word_of_nat idx \<noteq> 0
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_untyped' False ptr sz idx s \<and> ptr \<noteq> 0 \<and> minUntypedSizeBits \<le> sz \<and> sz \<le> maxUntypedSizeBits \<and> idx \<le> 2 ^ sz \<and> is_aligned (word_of_nat idx) minUntypedSizeBits; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; 0 < idx\<rbrakk> \<Longrightarrow> unat (word_of_nat idx) - 1 < 2 ^ sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 6. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 7. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 8. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 9. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (9 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (- 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. - 1 div 2 ^ resetChunkBits]) ! i) = (unat (- 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; sz < word_bits; \<not> ptr - 1 < ptr; 0 < idx; valid_untyped' False ptr sz idx s; ptr \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; word_of_nat idx = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_untyped' False ptr sz idx s \<and> ptr \<noteq> 0 \<and> minUntypedSizeBits \<le> sz \<and> sz \<le> maxUntypedSizeBits \<and> idx \<le> 2 ^ sz \<and> is_aligned (word_of_nat idx) minUntypedSizeBits; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; 0 < idx\<rbrakk> \<Longrightarrow> unat (word_of_nat idx) - 1 < 2 ^ sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 6. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 7. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 8. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 9. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (10 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (- 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. - 1 div 2 ^ resetChunkBits]) ! i) = (unat (- 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; sz < word_bits; \<not> ptr - 1 < ptr; 0 < idx; valid_untyped' False ptr sz idx s; ptr \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz\<rbrakk> \<Longrightarrow> idx < 2 ^ word_bits
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (- 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. - 1 div 2 ^ resetChunkBits]) ! i) = (unat (- 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; sz < word_bits; \<not> ptr - 1 < ptr; 0 < idx; valid_untyped' False ptr sz idx s; ptr \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; idx = 0\<rbrakk> \<Longrightarrow> False
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_untyped' False ptr sz idx s \<and> ptr \<noteq> 0 \<and> minUntypedSizeBits \<le> sz \<and> sz \<le> maxUntypedSizeBits \<and> idx \<le> 2 ^ sz \<and> is_aligned (word_of_nat idx) minUntypedSizeBits; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; 0 < idx\<rbrakk> \<Longrightarrow> unat (word_of_nat idx) - 1 < 2 ^ sz
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 6. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 7. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 8. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 9. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 10. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (9 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (- 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. - 1 div 2 ^ resetChunkBits]) ! i) = (unat (- 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; sz < word_bits; \<not> ptr - 1 < ptr; 0 < idx; valid_untyped' False ptr sz idx s; ptr \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; idx = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_untyped' False ptr sz idx s \<and> ptr \<noteq> 0 \<and> minUntypedSizeBits \<le> sz \<and> sz \<le> maxUntypedSizeBits \<and> idx \<le> 2 ^ sz \<and> is_aligned (word_of_nat idx) minUntypedSizeBits; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; 0 < idx\<rbrakk> \<Longrightarrow> unat (word_of_nat idx) - 1 < 2 ^ sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 6. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 7. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 8. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 9. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (8 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; valid_untyped' False ptr sz idx s \<and> ptr \<noteq> 0 \<and> minUntypedSizeBits \<le> sz \<and> sz \<le> maxUntypedSizeBits \<and> idx \<le> 2 ^ sz \<and> is_aligned (word_of_nat idx) minUntypedSizeBits; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; 0 < idx\<rbrakk> \<Longrightarrow> unat (word_of_nat idx) - 1 < 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 6. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 7. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 8. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (8 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev (map (\<lambda>x. ptr + x * 2 ^ resetChunkBits) [0 .e. (word_of_nat idx - 1) div 2 ^ resetChunkBits]) ! i) = (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i) * 2 ^ resetChunkBits; sz < word_bits; \<not> ptr + word_of_nat idx - 1 < ptr; 0 < idx; valid_untyped' False ptr sz idx s; ptr \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> idx mod 4294967296 - Suc 0 < 2 ^ sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 5. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 6. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 7. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 8. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (7 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> resetChunkBits \<le> sz
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 4. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 5. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 6. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 7. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (6 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s; resetChunkBits < word_bits \<and> sz < word_bits\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set slots. x \<noteq> slot) \<and> minUntypedSizeBits \<le> resetChunkBits \<and> True
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 4. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 5. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 6. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits \<and> sz < word_bits
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! i) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 2. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 3. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 4. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> getFreeIndex ptr ([ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] ! (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i)) = (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - Suc i) * 2 ^ resetChunkBits
 2. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 3. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 4. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < length (if ptr + word_of_nat idx - 1 < ptr then [] else map (\<lambda>x. ptr + x * (ptr + 2 ^ resetChunkBits - ptr)) [0 .e. (ptr + word_of_nat idx - 1 - ptr) div (ptr + 2 ^ resetChunkBits - ptr)]); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits)\<rbrakk> \<Longrightarrow> (ptr + word_of_nat idx - 1 < ptr \<longrightarrow> unat ([] ! 0 - ptr) = 0) \<and> (\<not> ptr + word_of_nat idx - 1 < ptr \<longrightarrow> unat (word_of_nat (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits) = (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits)
 2. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 3. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 4. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> unat (((word_of_nat idx - 1) div 2 ^ resetChunkBits - word_of_nat i) * 2 ^ resetChunkBits) = (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits
 2. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 3. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 4. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr; resetChunkBits < word_bits\<rbrakk> \<Longrightarrow> unat (((word_of_nat idx - 1) div 2 ^ resetChunkBits - word_of_nat i) * 2 ^ resetChunkBits) = (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (6 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr; resetChunkBits < word_bits\<rbrakk> \<Longrightarrow> word_of_nat (unat (((word_of_nat idx - 1) div 2 ^ resetChunkBits - word_of_nat i) * 2 ^ resetChunkBits)) = word_of_nat ((unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits)
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr; resetChunkBits < word_bits\<rbrakk> \<Longrightarrow> (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits \<in> unats LENGTH(32)
 3. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 4. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 5. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 6. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr; resetChunkBits < word_bits\<rbrakk> \<Longrightarrow> (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits \<in> unats LENGTH(32)
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr; resetChunkBits < word_bits\<rbrakk> \<Longrightarrow> (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits) - i) * 2 ^ resetChunkBits \<in> {i. i < 2 ^ word_bits}
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr; resetChunkBits < word_bits\<rbrakk> \<Longrightarrow> unat (word_of_nat idx - 1) div 2 ^ resetChunkBits - i < 2 ^ (word_bits - resetChunkBits)
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr; resetChunkBits < word_bits\<rbrakk> \<Longrightarrow> unat (word_of_nat idx - 1) div 2 ^ resetChunkBits < 2 ^ (word_bits - resetChunkBits)
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (5 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat (word_of_nat idx - 1) div 2 ^ resetChunkBits); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr; resetChunkBits < word_bits\<rbrakk> \<Longrightarrow> unat (word_of_nat idx - 1) < 2 ^ word_bits
 2. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 3. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 4. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 5. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (4 subgoals):
 1. \<And>x s ty us slots i sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; st_tcb_at' active' (ksCurThread s) s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits \<and> minUntypedSizeBits \<le> us; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; i < Suc (unat ((word_of_nat idx - 1) div 2 ^ resetChunkBits)); \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; descendants_of' slot (ctes_of sa) = {}; st_tcb_at' active' (ksCurThread sa) sa; ptr && ~~ mask sz = ptr; range_cover ptr sz (APIType_capBits ty us) (length slots); ksSchedulerAction sa = ResumeCurrentThread \<or> ksSchedulerAction sa = ChooseNewThread; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; \<forall>slot\<in>set slots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz (if i = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - i) * 2 ^ resetChunkBits); \<not> ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 2. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 3. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 4. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (3 subgoals):
 1. \<And>x s ty us slots rv sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1]) = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - length (rev [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1])) * 2 ^ resetChunkBits)))) sa\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<exists>sza. (\<exists>idx cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.UntypedCap False ptr sza idx \<and> capability.UntypedCap False ptr sz 0 = cteCap cte) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa
 2. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 3. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (3 subgoals):
 1. \<And>x s ty us slots sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; ct_active' sa; range_cover ptr sz (APIType_capBits ty us) (length slots); ctes_of sa slot = Some cte; ptr && ~~ mask sz = ptr; cteCap cte = capability.UntypedCap False ptr sz idx; descendants_of' slot (ctes_of sa) = {}; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; sch_act_simple sa; ptr + word_of_nat idx - 1 < ptr\<rbrakk> \<Longrightarrow> False
 2. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 3. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (3 subgoals):
 1. \<And>x s ty us slots sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; ct_active' sa; range_cover ptr sz (APIType_capBits ty us) (length slots); ctes_of sa slot = Some cte; ptr && ~~ mask sz = ptr; cteCap cte = capability.UntypedCap False ptr sz idx; descendants_of' slot (ctes_of sa) = {}; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; sch_act_simple sa; ptr + word_of_nat idx - 1 < ptr; valid_cap' (capability.UntypedCap False ptr sz idx) s\<rbrakk> \<Longrightarrow> False
 2. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 3. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (3 subgoals):
 1. \<And>x s ty us slots sa cte. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev; \<not> sz < resetChunkBits; invs' sa; pspace_no_overlap' ptr sz sa; ct_active' sa; range_cover ptr sz (APIType_capBits ty us) (length slots); ctes_of sa slot = Some cte; cteCap cte = capability.UntypedCap False ptr sz idx; descendants_of' slot (ctes_of sa) = {}; \<forall>slot\<in>set slots. \<exists>cte. ctes_of sa slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; sch_act_simple sa; ptr + word_of_nat idx - 1 < ptr; is_aligned ptr sz; sz < word_bits; valid_untyped' False ptr sz idx s; ptr \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> False
 2. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 3. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (2 subgoals):
 1. \<And>x s ty us slots e sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; invs' sa\<rbrakk> \<Longrightarrow> invs' sa
 2. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal (1 subgoal):
 1. \<And>x s ty us slots sa. \<lbrakk>ctes_of s slot = Some x; invs' s; ct_active' s; ui = Invocations_H.untyped_invocation.Retype slot True ptr ptr ty us slots False; range_cover ptr sz (APIType_capBits ty us) (length slots); ptr && ~~ mask sz = ptr; descendants_of' slot (ctes_of s) = {}; slot \<notin> set slots; distinct slots; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; slots \<noteq> []; APIType_capBits ty us \<le> maxUntypedSizeBits; capAligned (capability.UntypedCap False ptr sz idx); 0 < idx; cteCap x = capability.UntypedCap False ptr sz idx; \<not> dev \<and> \<not> sz < resetChunkBits; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False ptr sza idxa \<and> capability.UntypedCap False ptr sz idx = cteCap cte) slot s) \<and> range_cover ptr sza (APIType_capBits ty us) (length slots) \<and> ptr && ~~ mask sza = ptr \<and> descendants_of' slot (ctes_of s) = {} \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> sch_act_simple s) and ct_active' and pspace_no_overlap' ptr sz) sa\<rbrakk> \<Longrightarrow> (invs' and pspace_no_overlap' ptr sz and ct_active' and valid_untyped_inv_wcap' ui (Some (capability.UntypedCap dev ptr sz (if 0 = 0 then idx else (length [ptr , ptr + 2 ^ resetChunkBits .e. getFreeRef ptr idx - 1] - 0) * 2 ^ resetChunkBits)))) sa proof (prove)
goal:
No subgoals!