theory Untyped_DR

lemma invoke_untyped_corres:
  "dcorres (dc \<oplus> dc) (\<lambda>_. True)
             (invs and ct_active and valid_untyped_inv untyped_invocation and valid_etcbs)
             (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation))
             (Retype_A.invoke_untyped untyped_invocation)" apply (rule dcorres_expand_pfx) apply (clarsimp simp only: valid_untyped_inv_wcap) apply (cases untyped_invocation) apply (rename_tac s s' sz idx creforef reset ptr ptr' tp us slots dev) proof - fix s cref reset ptr ptr' tp us slots sz idx dev assume vui1: "valid_untyped_inv_wcap untyped_invocation
         (Some (case untyped_invocation of
                Invocations_A.untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow>
                  cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s"
    and ui: "untyped_invocation =
        Invocations_A.Retype cref reset ptr' ptr tp us slots dev"
    and etc: "valid_etcbs s" "invs s" "ct_active s" note vui = vui1[simplified ui Invocations_A.untyped_invocation.simps] have ptrs: "ptr' = ptr && ~~ mask sz" using vui by (auto simp: ui cte_wp_at_caps_of_state word_bw_assocs) have cover: "range_cover ptr sz (obj_bits_api tp us) (length slots)"
   and vslot: "slots \<noteq> []" "distinct slots"
    and misc: "tp = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us"
              "tp = Structures_A.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us" using vui by (auto simp: ui cte_wp_at_caps_of_state) have vcap: "s \<turnstile> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx" using vui etc by (auto simp: ui cte_wp_at_caps_of_state
            dest!: caps_of_state_valid[rotated]) note [simp del] = usable_untyped_range.simps atLeastAtMost_iff
                    atLeastatMost_subset_iff split_paired_Ex show  "dcorres (dc \<oplus> dc) ((=) (transform s)) ((=) s)
           (Untyped_D.invoke_untyped
             (translate_untyped_invocation untyped_invocation))
           (Retype_A.invoke_untyped untyped_invocation)" supply option.case_cong[cong] if_cong[cong] apply (clarsimp simp: Untyped_D.invoke_untyped_def mapM_x_def translate_untyped_invocation_def
                          ui ptrs invoke_untyped_def unlessE_whenE) apply (rule corres_guard_imp) apply (rule corres_split_norE) apply (rule corres_whenE, simp) apply (rule reset_untyped_cap_corres[where idx=idx]) apply simp apply simp apply (rule corres_split) apply (rule get_cap_corres; simp) apply simp apply (rule generate_object_ids_exec[where ptr = ptr and us = us and sz = sz]) apply simp apply (rule corres_split[OF update_available_range_dcorres]) apply simp apply (rule corres_split[OF retype_region_dcorres[where sz = sz]]) apply (rule corres_split_noop_rhs) apply (rule init_arch_objects_corres_noop[where sz =sz]) apply clarsimp apply (erule retype_addrs_aligned[OF _ range_cover.aligned _ le_refl]) apply (rule cover) apply (rule range_cover_sz'[where 'a=32, folded word_bits_def, OF cover]) apply (rule cover) apply (simp add: vslot) apply (simp add: liftM_def[symmetric] mapM_x_def[symmetric]
                                zip_map1 zip_map2 o_def split_beta dc_def[symmetric]) apply (rule_tac F = " (untyped_is_device (transform_cap cap)) = dev" in corres_gen_asm2) apply clarify apply (rule create_caps_loop_dcorres) apply ((wp | simp add: mdb_cte_at_def | rule hoare_vcg_conj_lift, wps)+)[2] supply send_signal_interrupt_states[wp_unsafe del] validNF_prop[wp_unsafe del] apply (wp retype_region_aligned_for_init[where sz = sz]
                    retype_region_obj_at[THEN hoare_vcg_const_imp_lift]
                    retype_region_caps_of[where sza = "\<lambda>_. sz"]
                 | simp add: misc)+ apply (rule_tac Q="\<lambda>rv s. cte_wp_at ((\<noteq>) cap.NullCap) cref s
                                      \<and> post_retype_invs tp rv s
                                      \<and> idle_thread s \<notin> fst ` set slots
                                      \<and> untyped_is_device (transform_cap cap) = dev
                                      \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s)
                                      \<and> valid_etcbs s"
                            in hoare_post_imp) apply (simp add:post_retype_invs_def split:if_split_asm) apply ((clarsimp dest!: set_zip_leftD
                                simp: vslot image_def invs_def valid_state_def valid_mdb_def
                                      cte_wp_at_caps_of_state
                     | intro conjI | drule (1) bspec | drule(1) mdb_cte_atD[rotated])+)[2] apply (wp retype_region_cte_at_other'[where sz= sz]
                      retype_region_post_retype_invs[where sz = sz]
                      hoare_vcg_const_Ball_lift retype_region_aligned_for_init)+ apply (clarsimp simp:conj_comms misc cover) apply (rule_tac Q="\<lambda>r s.
               cte_wp_at (\<lambda>cp. \<exists>idx. cp = (cap.UntypedCap dev ptr' sz idx)) cref s \<and>
               invs s \<and> pspace_no_overlap_range_cover ptr sz s \<and> caps_no_overlap ptr sz s \<and>
               region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and>
               caps_overlap_reserved {ptr..ptr + of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and>
               idle_thread s \<notin> fst ` set slots
               \<and> untyped_is_device (transform_cap cap) = dev
               \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s"
               in hoare_strengthen_post[rotated]) apply (clarsimp simp: invs_mdb invs_valid_pspace cte_wp_at_caps_of_state misc split_paired_Ex) apply (rule conjI,clarsimp) apply (erule ranE) apply (clarsimp simp:null_filter_def split:if_splits) apply (frule_tac cap = capa in caps_of_state_ko[OF caps_of_state_valid]) apply assumption apply (elim disjE) apply (clarsimp simp:cap_range_def is_cap_simps)+ apply (rule disjointI) apply clarsimp apply (drule bspec,fastforce,clarsimp) apply (drule(1) pspace_no_overlap_obj_range) apply (drule p_in_obj_range) apply clarsimp+ apply (auto simp: field_simps)[1] apply (cases cref, simp, intro exI, rule conjI, assumption,
                  simp add: atLeastatMost_subset_iff word_and_le2 ptrs field_simps) apply (rule_tac P="bits_of cap = sz" in hoare_gen_asm) apply (simp add:bits_of_def) apply (strengthen caps_region_kernel_window_imp[where p=cref] invs_cap_refs_in_kernel_window)+ apply (wp set_cap_no_overlap hoare_vcg_ball_lift
                    set_free_index_invs[where 'a=det_ext and
                                               cap = "cap.UntypedCap dev (ptr && ~~ mask sz) sz
                                                                     (if reset then 0 else idx)",
                                               simplified]
                    set_cap_cte_wp_at set_cap_descendants_range_in set_cap_caps_no_overlap
                    set_untyped_cap_caps_overlap_reserved set_cap_cte_cap_wp_to hoare_vcg_ex_lift) apply wp apply (simp split del: if_split) apply (wp get_cap_wp)+ apply (wp (once) hoare_drop_imps) apply wp apply ((rule validE_validE_R)?,
             rule_tac E="\<top>\<top>" and
                      Q="\<lambda>_. valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation
                                (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active
                             and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr' .. ptr' + 2 ^ sz - 1} s)"
                      in hoare_post_impErr) apply (wp whenE_wp) apply (rule validE_validE_R, rule hoare_post_impErr, rule reset_untyped_cap_invs_etc) apply (clarsimp simp only: if_True simp_thms ptrs, intro conjI, assumption+) apply simp apply (clarsimp simp only: ui ptrs) apply (frule(2) invoke_untyped_proofs.intro) apply (clarsimp simp: ui cte_wp_at_caps_of_state bits_of_def empty_descendants_range_in exI
                             free_index_of_def untyped_range_def if_split[where P="\<lambda>x. x \<le> unat v" for v]
                  split del: if_split) apply (frule(1) valid_global_refsD2[OF _ invs_valid_global_refs]) apply (strengthen refl subseteq_set_minus free_range_of_untyped_subseteq'
                         range_le_free_range_of_untyped[mk_strg I E]
                         caps_region_kernel_window_imp[where p=cref])+ apply (simp only: word_size word_bits_def[symmetric]) apply (clarsimp simp: conj_comms invoke_untyped_proofs.simps range_le_free_range_of_untyped
                             if_split[where P="\<lambda>x. x \<le> unat v" for v]
                  split del: if_split) apply (simp add: arg_cong[OF mask_out_sub_mask, where f="\<lambda>y. x - y" for x]
                        field_simps invoke_untyped_proofs.idx_le_new_offs
                        invoke_untyped_proofs.idx_compare'
                        untyped_range_def invs_valid_idle invs_valid_pspace
                        is_aligned_neg_mask invoke_untyped_proofs.szw
                        free_range_of_untyped_pick_retype_addrs vslot
             split del: if_split) apply (clarsimp simp: detype_clear_um_independent conj_comms not_idle_thread_def
                             misc invs_valid_idle invs_valid_objs word_bits_def word_and_le2
                             atLeastatMost_subset_iff[where b=x and d=x for x]
                 split del: if_split) apply (clarsimp simp: range_cover.aligned bits_of_def field_simps split del: if_split) apply (intro conjI) apply (cases cref, fastforce dest: valid_idle_has_null_cap[rotated -1]) apply (fastforce dest: ex_cte_cap_to_not_idle) apply (cases reset) apply (simp, erule pspace_no_overlap_subset) apply (simp add: atLeastatMost_subset_iff word_and_le2) apply (clarsimp simp: field_simps dest!: invoke_untyped_proofs.ps_no_overlap) apply (auto dest: invoke_untyped_proofs.idx_le_new_offs)[1] apply (strengthen invoke_untyped_proofs.subset_stuff[THEN order_trans, mk_strg I E]) apply (simp add: atLeastatMost_subset_iff word_and_le2) apply (drule invoke_untyped_proofs.usable_range_disjoint) apply (clarsimp simp: field_simps mask_out_sub_mask shiftl_t2n) apply simp apply simp apply (cut_tac vui1) apply (clarsimp simp add: etc ptrs) apply (clarsimp simp: ui cte_wp_at_caps_of_state valid_cap_simps free_index_of_def) apply auto done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and ct_active and valid_untyped_inv untyped_invocation and valid_etcbs) (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>s = transform s'; True; (invs and ct_active and valid_untyped_inv untyped_invocation and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) s) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. \<And>s s' sz idx. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. \<And>s s' sz idx x1 x2 x3 x4 x5 x6 x7 x8. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype x1 x2 x3 x4 x5 x6 x7 x8\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. \<And>s s' sz idx creforef reset ptr ptr' tp us slots dev. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype creforef reset ptr ptr' tp us slots dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (state)
goal (1 subgoal):
 1. \<And>s s' sz idx creforef reset ptr ptr' tp us slots dev. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype creforef reset ptr ptr' tp us slots dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (state)
goal (1 subgoal):
 1. \<And>s s' sz idx creforef reset ptr ptr' tp us slots dev. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype creforef reset ptr ptr' tp us slots dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (state)
this:
valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s
untyped_invocation = untyped_invocation.Retype cref reset ptr' ptr tp us slots dev
valid_etcbs s
invs s
ct_active s

goal (1 subgoal):
 1. \<And>s s' sz idx creforef reset ptr ptr' tp us slots dev. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype creforef reset ptr ptr' tp us slots dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (state)
this:
valid_untyped_inv_wcap (untyped_invocation.Retype cref reset ptr' ptr tp us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. \<And>s s' sz idx creforef reset ptr ptr' tp us slots dev. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype creforef reset ptr ptr' tp us slots dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. ptr' = ptr && ~~ mask sz proof (prove)
using this:
valid_untyped_inv_wcap (untyped_invocation.Retype cref reset ptr' ptr tp us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. ptr' = ptr && ~~ mask sz proof (state)
this:
ptr' = ptr && ~~ mask sz

goal (1 subgoal):
 1. \<And>s s' sz idx creforef reset ptr ptr' tp us slots dev. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype creforef reset ptr ptr' tp us slots dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. range_cover ptr sz (obj_bits_api tp us) (length slots) &&& (slots \<noteq> [] &&& distinct slots) &&& tp = CapTableObject \<longrightarrow> 0 < us &&& tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us proof (prove)
using this:
valid_untyped_inv_wcap (untyped_invocation.Retype cref reset ptr' ptr tp us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. range_cover ptr sz (obj_bits_api tp us) (length slots) &&& (slots \<noteq> [] &&& distinct slots) &&& tp = CapTableObject \<longrightarrow> 0 < us &&& tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us proof (state)
this:
range_cover ptr sz (obj_bits_api tp us) (length slots)
slots \<noteq> []
distinct slots
tp = CapTableObject \<longrightarrow> 0 < us
tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us

goal (1 subgoal):
 1. \<And>s s' sz idx creforef reset ptr ptr' tp us slots dev. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype creforef reset ptr ptr' tp us slots dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. s \<turnstile> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx proof (prove)
using this:
valid_untyped_inv_wcap (untyped_invocation.Retype cref reset ptr' ptr tp us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s
valid_etcbs s
invs s
ct_active s

goal (1 subgoal):
 1. s \<turnstile> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx proof (state)
this:
s \<turnstile> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx

goal (1 subgoal):
 1. \<And>s s' sz idx creforef reset ptr ptr' tp us slots dev. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype creforef reset ptr ptr' tp us slots dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (state)
this:
usable_untyped_range (cap.UntypedCap ?uu ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})
(?i \<in> {?l..?u}) = (?l \<le> ?i \<and> ?i \<le> ?u)
({?a..?b} \<subseteq> {?c..?d}) = (\<not> ?a \<le> ?b \<or> ?c \<le> ?a \<and> ?b \<le> ?d)
(\<exists>x. ?P x) = (\<exists>a b. ?P (a, b))

goal (1 subgoal):
 1. \<And>s s' sz idx creforef reset ptr ptr' tp us slots dev. \<lbrakk>True; valid_etcbs s'; invs s'; ct_active s'; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s'; untyped_invocation = untyped_invocation.Retype creforef reset ptr ptr' tp us slots dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> dc) ((=) (transform s)) ((=) s) (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> dc) ((=) (transform s)) ((=) s) (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation) proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> dc) ((=) (transform s)) ((=) s) (doE y <- whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref));
liftE (do untyped_cap <- KHeap_D.get_cap (transform_cslot_ptr cref);
new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range untyped_cap);
y <- update_available_range (available_range untyped_cap) (map pick new_obj_refs) (transform_cslot_ptr cref) untyped_cap;
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device untyped_cap)) (zip (map transform_cslot_ptr slots) new_obj_refs))
od)
odE) (doE y <- whenE reset (Retype_A.reset_untyped_cap cref);
liftE (do cap <- CSpaceAcc_A.get_cap cref;
y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
odE) proof (prove)
goal (3 subgoals):
 1. dcorres (dc \<oplus> dc) ?Q1 ?Q'1 (doE y <- whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref));
liftE (do untyped_cap <- KHeap_D.get_cap (transform_cslot_ptr cref);
new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range untyped_cap);
y <- update_available_range (available_range untyped_cap) (map pick new_obj_refs) (transform_cslot_ptr cref) untyped_cap;
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device untyped_cap)) (zip (map transform_cslot_ptr slots) new_obj_refs))
od)
odE) (doE y <- whenE reset (Retype_A.reset_untyped_cap cref);
liftE (do cap <- CSpaceAcc_A.get_cap cref;
y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
odE)
 2. \<And>sa. transform s = sa \<Longrightarrow> ?Q1 sa
 3. \<And>sa. s = sa \<Longrightarrow> ?Q'1 sa proof (prove)
goal (6 subgoals):
 1. dcorres (dc \<oplus> dc) ?P5 ?P'5 (whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref))) (whenE reset (Retype_A.reset_untyped_cap cref))
 2. dcorres (dc \<oplus> dc) ?R5 ?R'5 (liftE (do untyped_cap <- KHeap_D.get_cap (transform_cslot_ptr cref);
new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range untyped_cap);
y <- update_available_range (available_range untyped_cap) (map pick new_obj_refs) (transform_cslot_ptr cref) untyped_cap;
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device untyped_cap)) (zip (map transform_cslot_ptr slots) new_obj_refs))
od)) (liftE (do cap <- CSpaceAcc_A.get_cap cref;
y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od))
 3. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. ?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. transform s = sa \<Longrightarrow> (?P5 and ?Q5) sa
 6. \<And>sa. s = sa \<Longrightarrow> (?P'5 and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. dcorres (dc \<oplus> dc) ?P10 ?P'10 (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) (Retype_A.reset_untyped_cap cref)
 2. dc () ()
 3. dcorres (dc \<oplus> dc) ?R5 ?R'5 (liftE (do untyped_cap <- KHeap_D.get_cap (transform_cslot_ptr cref);
new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range untyped_cap);
y <- update_available_range (available_range untyped_cap) (map pick new_obj_refs) (transform_cslot_ptr cref) untyped_cap;
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device untyped_cap)) (zip (map transform_cslot_ptr slots) new_obj_refs))
od)) (liftE (do cap <- CSpaceAcc_A.get_cap cref;
y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od))
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. ?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> ?P10 s) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> ?P'10 s) and ?Q'5) sa proof (prove)
goal (6 subgoals):
 1. dc () ()
 2. dcorres (dc \<oplus> dc) ?R5 ?R'5 (liftE (do untyped_cap <- KHeap_D.get_cap (transform_cslot_ptr cref);
new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range untyped_cap);
y <- update_available_range (available_range untyped_cap) (map pick new_obj_refs) (transform_cslot_ptr cref) untyped_cap;
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device untyped_cap)) (zip (map transform_cslot_ptr slots) new_obj_refs))
od)) (liftE (do cap <- CSpaceAcc_A.get_cap cref;
y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od))
 3. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. ?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 6. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (5 subgoals):
 1. dcorres (dc \<oplus> dc) ?R5 ?R'5 (liftE (do untyped_cap <- KHeap_D.get_cap (transform_cslot_ptr cref);
new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range untyped_cap);
y <- update_available_range (available_range untyped_cap) (map pick new_obj_refs) (transform_cslot_ptr cref) untyped_cap;
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device untyped_cap)) (zip (map transform_cslot_ptr slots) new_obj_refs))
od)) (liftE (do cap <- CSpaceAcc_A.get_cap cref;
y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od))
 2. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. ?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 5. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (5 subgoals):
 1. dcorres dc ?R5 ?R'5 (do untyped_cap <- KHeap_D.get_cap (transform_cslot_ptr cref);
new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range untyped_cap);
y <- update_available_range (available_range untyped_cap) (map pick new_obj_refs) (transform_cslot_ptr cref) untyped_cap;
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device untyped_cap)) (zip (map transform_cslot_ptr slots) new_obj_refs))
od) (do cap <- CSpaceAcc_A.get_cap cref;
y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
 2. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. ?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. ?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 5. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (8 subgoals):
 1. dcorres ?r'15 ?P15 ?P'15 (KHeap_D.get_cap (transform_cslot_ptr cref)) (CSpaceAcc_A.get_cap cref)
 2. \<And>untyped_cap cap. ?r'15 untyped_cap cap \<Longrightarrow> dcorres dc (?R15 untyped_cap) (?R'15 cap) (do new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range untyped_cap);
y <- update_available_range (available_range untyped_cap) (map pick new_obj_refs) (transform_cslot_ptr cref) untyped_cap;
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device untyped_cap)) (zip (map transform_cslot_ptr slots) new_obj_refs))
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
 3. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>?R15\<rbrace>
 4. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>?R'15\<rbrace>
 5. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. ?P15 and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. ?P'15 and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 8. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> dcorres dc (?R15 untyped_cap) (?R'15 cap) (do new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range untyped_cap);
y <- update_available_range (available_range untyped_cap) (map pick new_obj_refs) (transform_cslot_ptr cref) untyped_cap;
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device untyped_cap)) (zip (map transform_cslot_ptr slots) new_obj_refs))
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>?R15\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>?R'15\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> dcorres dc (?R15 (transform_cap cap)) (?R'15 cap) (do new_obj_refs <- generate_object_ids (length slots) (translate_object_type tp) (available_range (transform_cap cap));
y <- update_available_range (available_range (transform_cap cap)) (map pick new_obj_refs) (transform_cslot_ptr cref) (transform_cap cap);
y <- Untyped_D.retype_region us (translate_object_type tp) new_obj_refs;
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) new_obj_refs))
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>?R15\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>?R'15\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> dcorres dc (?R15 (transform_cap cap)) (?P'30 cap) (do y <- update_available_range (available_range (transform_cap cap)) (map pick (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) (transform_cslot_ptr cref) (transform_cap cap);
y <- Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us));
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>?R15\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and ?P'30 a\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> dcorres (\<lambda>a b. True) (?R15 (transform_cap cap)) (?P'30 cap) (do y <- update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap);
y <- Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us));
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref;
orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>?R15\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and ?P'30 a\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>untyped_cap cap rv rv'. \<lbrakk>untyped_cap = transform_cap cap; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R32 untyped_cap cap rv) (?R'32 untyped_cap cap rv') (do y <- Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us));
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))
od) (do orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
 2. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>?R32 untyped_cap cap\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>?R'32 untyped_cap cap\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> dcorres (\<lambda>a b. True) (?R32 (transform_cap cap) cap ()) (?R'32 (transform_cap cap) cap ()) (do y <- Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us));
sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))
od) (do orefs <- Retype_A.retype_region ptr (length slots) us tp dev;
y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
 2. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>?R32 untyped_cap cap\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>?R'32 untyped_cap cap\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (11 subgoals):
 1. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R43 untyped_cap cap y) (?R'43 untyped_cap cap orefs) (sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))) (do y <- init_arch_objects tp ptr (length slots) us orefs;
sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs))
od)
 2. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>?R43 untyped_cap cap\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>?R'43 untyped_cap cap\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 6. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 7. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 8. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres dc (?P55 untyped_cap cap y) (?P'57 untyped_cap cap orefs) (return ()) (init_arch_objects tp ptr (length slots) us orefs)
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R56 untyped_cap cap y) (?R'54 untyped_cap cap y orefs) (sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))) (sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs)))
 3. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?R'54 untyped_cap cap y orefs\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. ?P55 untyped_cap cap y and ?R56 untyped_cap cap y\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. ?P'57 untyped_cap cap orefs and ?Q'58 untyped_cap cap orefs\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 7. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 8. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 9. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 10. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<forall>x\<in>set orefs. is_aligned x (obj_bits_api tp us)
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> range_cover ptr sz (obj_bits_api tp us) (length slots)
 3. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> 0 < length slots
 4. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R56 untyped_cap cap y) (?R'54 untyped_cap cap y orefs) (sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))) (sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs)))
 5. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?R'54 untyped_cap cap y orefs\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 7. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 8. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 9. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 10. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x. x \<in> set (retype_addrs ptr tp (length slots) us) \<Longrightarrow> is_aligned x (obj_bits_api tp us)
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> range_cover ptr sz (obj_bits_api tp us) (length slots)
 3. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> 0 < length slots
 4. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R56 untyped_cap cap y) (?R'54 untyped_cap cap y orefs) (sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))) (sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs)))
 5. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?R'54 untyped_cap cap y orefs\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 7. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 8. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 9. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 10. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x. range_cover ptr (?sz84 x) (obj_bits_api tp us) (?n84 x)
 2. \<And>x. obj_bits_api tp us < word_bits
 3. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> range_cover ptr sz (obj_bits_api tp us) (length slots)
 4. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> 0 < length slots
 5. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R56 untyped_cap cap y) (?R'54 untyped_cap cap y orefs) (sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))) (sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs)))
 6. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?R'54 untyped_cap cap y orefs\<rbrace>
 7. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 8. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 9. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 10. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x. obj_bits_api tp us < word_bits
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> range_cover ptr sz (obj_bits_api tp us) (length slots)
 3. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> 0 < length slots
 4. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R56 untyped_cap cap y) (?R'54 untyped_cap cap y orefs) (sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))) (sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs)))
 5. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?R'54 untyped_cap cap y orefs\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 7. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 8. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 9. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 10. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> range_cover ptr sz (obj_bits_api tp us) (length slots)
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> 0 < length slots
 3. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R56 untyped_cap cap y) (?R'54 untyped_cap cap y orefs) (sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))) (sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs)))
 4. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?R'54 untyped_cap cap y orefs\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 7. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 8. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 9. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 10. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> 0 < length slots
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R56 untyped_cap cap y) (?R'54 untyped_cap cap y orefs) (sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))) (sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs)))
 3. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?R'54 untyped_cap cap y orefs\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 7. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 8. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 9. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 10. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R56 untyped_cap cap y) (?R'54 untyped_cap cap y orefs) (sequence_x (map (Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap))) (zip (map transform_cslot_ptr slots) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))))) (sequence_x (map (Retype_A.create_cap tp us cref dev) (zip slots orefs)))
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?R'54 untyped_cap cap y orefs\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 7. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 8. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 9. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>untyped_cap cap y. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)\<rbrakk> \<Longrightarrow> dcorres dc (?R56 (transform_cap cap) cap (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) (?R'54 (transform_cap cap) cap (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (retype_addrs ptr tp (length slots) us)) (mapM_x (\<lambda>x. Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap)) (transform_cslot_ptr (fst x), retype_transform_obj_ref tp us (snd x))) (zip slots (retype_addrs ptr tp (length slots) us))) (mapM_x (Retype_A.create_cap tp us cref dev) (zip slots (retype_addrs ptr tp (length slots) us)))
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?R'54 untyped_cap cap y orefs\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 7. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 8. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 9. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>untyped_cap cap y. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us); untyped_is_device (transform_cap cap) = dev\<rbrakk> \<Longrightarrow> dcorres dc (?R56 (transform_cap cap) cap (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) (?P'92 (transform_cap cap) cap (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (retype_addrs ptr tp (length slots) us)) (mapM_x (\<lambda>x. Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap)) (transform_cslot_ptr (fst x), retype_transform_obj_ref tp us (snd x))) (zip slots (retype_addrs ptr tp (length slots) us))) (mapM_x (Retype_A.create_cap tp us cref dev) (zip slots (retype_addrs ptr tp (length slots) us)))
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?P'92 untyped_cap cap y orefs and (\<lambda>s. untyped_is_device untyped_cap = dev)\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 7. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 8. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 9. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>untyped_cap cap y. dev = untyped_is_device (transform_cap cap) \<Longrightarrow> dcorres dc (?R56 (transform_cap cap) cap (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) (?P'92 (transform_cap cap) cap (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (retype_addrs ptr tp (length slots) us)) (mapM_x (\<lambda>x. Untyped_D.create_cap (translate_object_type tp) us (transform_cslot_ptr cref) (untyped_is_device (transform_cap cap)) (transform_cslot_ptr (fst x), retype_transform_obj_ref tp us (snd x))) (zip slots (retype_addrs ptr tp (length slots) us))) (mapM_x (Retype_A.create_cap tp us cref (untyped_is_device (transform_cap cap))) (zip slots (retype_addrs ptr tp (length slots) us)))
 2. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. ?P'92 untyped_cap cap y orefs and (\<lambda>s. untyped_is_device untyped_cap = dev)\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?R56 untyped_cap cap y\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 6. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 7. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 8. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 9. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>untyped_cap cap y orefs. \<lbrakk>untyped_cap = transform_cap cap; y = map (retype_transform_obj_ref tp us) orefs \<and> orefs = retype_addrs ptr tp (length slots) us\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 untyped_cap cap orefs\<rbrace> init_arch_objects tp ptr (length slots) us orefs \<lbrace>\<lambda>x. (\<lambda>a. cte_wp_at ((\<noteq>) cap.NullCap) cref a \<and> valid_idle a \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> idle_thread a \<notin> fst ` fst ` set (zip slots orefs) \<and> distinct (cref # map fst (zip slots orefs)) \<and> (\<forall>tup\<in>set (zip slots orefs). cte_wp_at ((=) cap.NullCap) (fst tup) a) \<and> valid_etcbs a) and (\<lambda>s. untyped_is_device untyped_cap = dev)\<rbrace>
 2. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q49 (transform_cap cap) cap ()\<rbrace> Untyped_D.retype_region us (translate_object_type tp) (map (retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and ?Q'58 untyped_cap cap orefs\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q49 untyped_cap cap a\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 6. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 7. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 8. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and (\<lambda>s. cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> valid_idle s \<and> (\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s \<and> cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s) \<and> idle_thread s \<notin> fst ` fst ` set (zip slots orefs) \<and> cref \<notin> set slots \<and> distinct slots \<and> (\<forall>tup\<in>set (zip slots orefs). cte_wp_at ((=) cap.NullCap) (fst tup) s) \<and> valid_etcbs s \<and> untyped_is_device untyped_cap = dev)\<rbrace>
 2. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'47 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>orefs. (\<lambda>s. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> (\<forall>x\<in>set (retype_addrs ptr tp (length slots) us). obj_at (\<lambda>ko. ko = Retype_A.default_object tp (?dev69 untyped_cap cap orefs) us) x s)) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s) and (\<lambda>s. cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> valid_idle s \<and> (\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s \<and> cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s) \<and> idle_thread s \<notin> fst ` fst ` set (zip slots orefs) \<and> cref \<notin> set slots \<and> distinct slots \<and> (\<forall>tup\<in>set (zip slots orefs). cte_wp_at ((=) cap.NullCap) (fst tup) s) \<and> valid_etcbs s \<and> untyped_is_device untyped_cap = dev)\<rbrace>
 2. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and ?Q'47 untyped_cap cap a\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?P'222 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>rv s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s \<and> cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> valid_idle s \<and> (\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s \<and> cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s) \<and> idle_thread s \<notin> fst ` fst ` set (zip slots rv) \<and> cref \<notin> set slots \<and> distinct slots \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at ((=) cap.NullCap) (fst tup) s) \<and> valid_etcbs s \<and> untyped_is_device (transform_cap cap) = dev\<rbrace>
 2. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and (\<lambda>b. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> True) \<and> (valid_pspace b \<and> valid_mdb b \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} b \<and> caps_no_overlap ptr sz b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> (\<exists>a ba. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, ba) b) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state b)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {})) \<and> ?P'222 untyped_cap cap a b)\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (10 subgoals):
 1. \<And>untyped_cap cap rv s. \<lbrakk>untyped_cap = transform_cap cap; cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> post_retype_invs tp rv s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> valid_etcbs s \<and> cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> valid_idle s \<and> (\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s \<and> cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s) \<and> idle_thread s \<notin> fst ` fst ` set (zip slots rv) \<and> cref \<notin> set slots \<and> distinct slots \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at ((=) cap.NullCap) (fst tup) s) \<and> valid_etcbs s \<and> untyped_is_device (transform_cap cap) = dev
 2. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?P'222 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>rv s. cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> post_retype_invs tp rv s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s) \<and> valid_etcbs s\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and (\<lambda>b. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> True) \<and> (valid_pspace b \<and> valid_mdb b \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} b \<and> caps_no_overlap ptr sz b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> (\<exists>a ba. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, ba) b) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state b)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {})) \<and> ?P'222 untyped_cap cap a b)\<rbrace>
 5. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 6. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 7. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 10. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (11 subgoals):
 1. \<And>untyped_cap cap rv s. \<lbrakk>untyped_cap = transform_cap cap; tp = ArchObject PageDirectoryObj; cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> equal_kernel_mappings (update_kheap (kheap s |` (- set rv)) s) \<and> valid_pspace s \<and> valid_mdb s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_vspace_objs s \<and> valid_irq_states s \<and> valid_global_objs s \<and> valid_arch_caps s \<and> valid_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> valid_ioc s \<and> valid_machine_state s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s \<and> cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s) \<and> idle_thread s \<notin> fst ` fst ` set (zip slots rv) \<and> cref \<notin> set slots \<and> distinct slots \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at ((=) cap.NullCap) (fst tup) s)
 2. \<And>untyped_cap cap rv s. \<lbrakk>untyped_cap = transform_cap cap; tp \<noteq> ArchObject PageDirectoryObj; cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> invs s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s) \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> (\<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s \<and> cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s) \<and> idle_thread s \<notin> fst ` fst ` set (zip slots rv) \<and> cref \<notin> set slots \<and> distinct slots \<and> (\<forall>tup\<in>set (zip slots rv). cte_wp_at ((=) cap.NullCap) (fst tup) s)
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?P'222 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>rv s. cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> post_retype_invs tp rv s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s) \<and> valid_etcbs s\<rbrace>
 4. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>
 5. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and (\<lambda>b. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> True) \<and> (valid_pspace b \<and> valid_mdb b \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} b \<and> caps_no_overlap ptr sz b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> (\<exists>a ba. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, ba) b) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state b)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {})) \<and> ?P'222 untyped_cap cap a b)\<rbrace>
 6. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 7. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 8. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?P'222 (transform_cap cap) cap ()\<rbrace> Retype_A.retype_region ptr (length slots) us tp dev \<lbrace>\<lambda>rv s. cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> post_retype_invs tp rv s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s) \<and> valid_etcbs s\<rbrace>
 2. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q38 (transform_cap cap)\<rbrace> update_available_range (available_range (transform_cap cap)) (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us)) (transform_cslot_ptr cref) (transform_cap cap) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>a. (\<lambda>s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) and (\<lambda>b. (tp \<noteq> apiobject_type.Untyped \<longrightarrow> True) \<and> (valid_pspace b \<and> valid_mdb b \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} b \<and> caps_no_overlap ptr sz b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> (\<exists>a ba. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, ba) b) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state b)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {})) \<and> ?P'222 untyped_cap cap a b)\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q38 a\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>untyped_cap cap. untyped_cap = transform_cap cap \<Longrightarrow> \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>rv s. pspace_no_overlap (up_aligned_area ptr sz) s \<and> (invs s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> (tp = CapTableObject \<longrightarrow> us \<noteq> 0)) \<and> (tp \<noteq> apiobject_type.Untyped \<longrightarrow> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> caps_no_overlap ptr sz s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {})) \<and> (pspace_no_overlap (up_aligned_area ptr sz) and cte_wp_at ((\<noteq>) cap.NullCap) cref and valid_pspace and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) s \<and> (invs and caps_no_overlap ptr sz and pspace_no_overlap (up_aligned_area ptr sz) and caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} and region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area ptr sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) and K (tp = CapTableObject \<longrightarrow> 0 < us) and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device untyped_cap = dev \<and> (\<forall>x\<in>set slots. (pspace_no_overlap (up_aligned_area ptr sz) and cte_wp_at ((=) cap.NullCap) x and valid_pspace and K (range_cover ptr sz (obj_bits_api tp us) (length slots))) s) \<and> valid_etcbs s\<rbrace>
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>rv s. invs s \<and> valid_mdb s \<and> valid_pspace s \<and> caps_no_overlap ptr sz s \<and> untyped_is_device (transform_cap cap) = dev \<and> valid_etcbs s \<and> idle_thread s \<notin> fst ` set slots \<and> cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot s) \<and> (\<forall>x\<in>set slots. valid_pspace s \<and> cte_wp_at ((=) cap.NullCap) x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> (\<exists>a b. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) (a, b) s)\<rbrace>
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (8 subgoals):
 1. \<And>cap rv s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s \<Longrightarrow> invs s \<and> valid_mdb s \<and> valid_pspace s \<and> caps_no_overlap ptr sz s \<and> untyped_is_device (transform_cap cap) = dev \<and> valid_etcbs s \<and> idle_thread s \<notin> fst ` set slots \<and> cte_wp_at ((\<noteq>) cap.NullCap) cref s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> (\<exists>slot. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) slot s) \<and> (\<forall>x\<in>set slots. valid_pspace s \<and> cte_wp_at ((=) cap.NullCap) x s \<and> pspace_no_overlap (up_aligned_area ptr sz) s) \<and> (\<exists>a b. cte_wp_at (\<lambda>c. cap_is_device c = dev \<and> up_aligned_area ptr sz \<subseteq> cap_range c) (a, b) s)
 2. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 3. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 4. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 5. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 8. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (8 subgoals):
 1. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> (\<forall>cap\<in>ran (null_filter (caps_of_state s)). obj_refs cap \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}) \<and> (\<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa)
 2. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 3. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 4. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 5. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 8. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<in> ran (null_filter (caps_of_state s))\<rbrakk> \<Longrightarrow> obj_refs capa \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa x. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; null_filter (caps_of_state s) x = Some capa\<rbrakk> \<Longrightarrow> obj_refs capa \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa a b. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa\<rbrakk> \<Longrightarrow> obj_refs capa \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (10 subgoals):
 1. \<And>cap s idx capa a b. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa\<rbrakk> \<Longrightarrow> caps_of_state s (?p555 cap s idx capa a b) = Some capa
 2. \<And>cap s idx capa a b. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; Structures_A.is_untyped_cap capa \<or> cap_range capa = {} \<or> (\<forall>ptr\<in>cap_range capa. \<exists>ko. kheap s ptr = Some ko)\<rbrakk> \<Longrightarrow> obj_refs capa \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 3. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 4. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 5. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 6. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 7. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 10. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa a b. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; Structures_A.is_untyped_cap capa \<or> cap_range capa = {} \<or> (\<forall>ptr\<in>cap_range capa. \<exists>ko. kheap s ptr = Some ko)\<rbrakk> \<Longrightarrow> obj_refs capa \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (11 subgoals):
 1. \<And>cap s idx capa a b. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; Structures_A.is_untyped_cap capa\<rbrakk> \<Longrightarrow> obj_refs capa \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 2. \<And>cap s idx capa a b. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; cap_range capa = {}\<rbrakk> \<Longrightarrow> obj_refs capa \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 3. \<And>cap s idx capa a b. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; \<forall>ptr\<in>cap_range capa. \<exists>ko. kheap s ptr = Some ko\<rbrakk> \<Longrightarrow> obj_refs capa \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 4. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 5. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 6. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 7. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 8. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa a b. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; \<forall>ptr\<in>untyped_range capa \<union> obj_refs capa. \<exists>ko. kheap s ptr = Some ko\<rbrakk> \<Longrightarrow> obj_refs capa \<inter> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa a b x y. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; \<forall>ptr\<in>untyped_range capa \<union> obj_refs capa. \<exists>ko. kheap s ptr = Some ko; x \<in> obj_refs capa; y \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> x \<noteq> y
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa a b y. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; \<forall>ptr\<in>untyped_range capa \<union> obj_refs capa. \<exists>ko. kheap s ptr = Some ko; y \<in> obj_refs capa; y \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> False
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa a b y ko. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; y \<in> obj_refs capa; y \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; kheap s y = Some ko\<rbrakk> \<Longrightarrow> False
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa a b y ko. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; y \<in> obj_refs capa; y \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; kheap s y = Some ko; obj_range y ko \<inter> up_aligned_area ptr sz = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (11 subgoals):
 1. \<And>cap s idx capa a b y ko. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; y \<in> obj_refs capa; y \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; obj_range y ko \<inter> up_aligned_area ptr sz = {}\<rbrakk> \<Longrightarrow> pspace_aligned s
 2. \<And>cap s idx capa a b y ko. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; y \<in> obj_refs capa; y \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; obj_range y ko \<inter> up_aligned_area ptr sz = {}\<rbrakk> \<Longrightarrow> valid_objs s
 3. \<And>cap s idx capa a b y ko. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; y \<in> obj_refs capa; y \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; obj_range y ko \<inter> up_aligned_area ptr sz = {}; y \<in> obj_range y ko\<rbrakk> \<Longrightarrow> False
 4. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 5. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 6. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 7. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 8. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>cap s idx capa a b y ko. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s; capa \<noteq> cap.NullCap; caps_of_state s (a, b) = Some capa; y \<in> obj_refs capa; y \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; obj_range y ko \<inter> up_aligned_area ptr sz = {}; y \<in> obj_range y ko\<rbrakk> \<Longrightarrow> False
 2. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 3. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 4. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 5. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 6. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (8 subgoals):
 1. \<And>cap s idx. \<lbrakk>invs s; caps_of_state s cref = Some (cap.UntypedCap (untyped_is_device (transform_cap cap)) ptr' sz idx); pspace_no_overlap (up_aligned_area ptr sz) s; caps_no_overlap ptr sz s; region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s; idle_thread s \<notin> fst ` set slots; dev = untyped_is_device (transform_cap cap); \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap; valid_etcbs s\<rbrakk> \<Longrightarrow> \<exists>a b capa. caps_of_state s (a, b) = Some capa \<and> cap_is_device capa = untyped_is_device (transform_cap cap) \<and> up_aligned_area ptr sz \<subseteq> cap_range capa
 2. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 3. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 4. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 5. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 8. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrace>?Q'37 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ?Q'37 a)\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>cap. bits_of cap = sz \<Longrightarrow> \<lbrace>?P'675 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of cap) (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and (?P'675 a and K (bits_of a = sz)))\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>cap. (case cap of cap.UntypedCap x xa bits xb \<Rightarrow> bits | cap.CNodeCap x radix_bits xa \<Rightarrow> radix_bits) = sz \<Longrightarrow> \<lbrace>?P'675 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> region_in_kernel_window {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and (?P'675 a and K (bits_of a = sz)))\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (7 subgoals):
 1. \<And>cap. (case cap of cap.UntypedCap x xa bits xb \<Rightarrow> bits | cap.CNodeCap x radix_bits xa \<Rightarrow> radix_bits) = sz \<Longrightarrow> \<lbrace>?P'675 cap\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) cref \<lbrace>\<lambda>r s. cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s \<and> invs s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> (\<exists>x. caps_of_state s cref = Some x \<and> invs s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> caps_overlap_reserved {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. cte_wp_at ((=) cap.NullCap) x s) \<and> valid_etcbs s\<rbrace>
 2. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 3. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and (?P'675 a and K (bits_of a = sz)))\<rbrace>
 4. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (6 subgoals):
 1. \<lbrace>?Q15\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 2. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ((\<lambda>s. ((\<lambda>s. if cref = cref then \<exists>idx. cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) = cap.UntypedCap dev ptr' sz idx else cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s) and cte_wp_at (\<lambda>_. True) cref) s \<and> (free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) s \<and> (\<exists>x. ((caps_of_state s)(cref \<mapsto> cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))))) cref = Some x \<and> (free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> (invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 a))) cref s) \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap a) = dev \<and> (\<forall>x\<in>set slots. ((\<lambda>s. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) and cte_wp_at (\<lambda>_. True) cref) s) \<and> valid_etcbs s) and K (bits_of a = sz)))\<rbrace>
 3. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 6. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (5 subgoals):
 1. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a. K ((tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a)) and pspace_no_overlap (up_aligned_area ptr sz) and valid_pspace and valid_idle and (K (\<exists>idx. transform_cap a = transform_cap (cap.UntypedCap dev (ptr && ~~ mask sz) (bits_of a) idx) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - set (map (pick \<circ> retype_transform_obj_ref tp us) (retype_addrs ptr tp (length slots) us))) and valid_idle and (\<lambda>s. fst cref \<noteq> idle_thread s) and valid_etcbs and ((\<lambda>s. ((\<lambda>s. if cref = cref then \<exists>idx. cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) = cap.UntypedCap dev ptr' sz idx else cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap dev ptr' sz idx) cref s) and cte_wp_at (\<lambda>_. True) cref) s \<and> (free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))))) cref and caps_no_overlap ptr sz) s \<and> (\<exists>x. ((caps_of_state s)(cref \<mapsto> cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))))) cref = Some x \<and> (free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> cap_range x) \<and> (invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 a))) cref s) \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap a) = dev \<and> (\<forall>x\<in>set slots. ((\<lambda>s. if x = cref then cap.NullCap = cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) else cte_wp_at ((=) cap.NullCap) x s) and cte_wp_at (\<lambda>_. True) cref) s) \<and> valid_etcbs s) and K (bits_of a = sz)))\<rbrace>
 2. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 5. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (5 subgoals):
 1. \<lbrace>?Q'15\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>a b. (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap a) \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> valid_pspace b \<and> valid_idle b \<and> (\<exists>idx. transform_cap a = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of a - 1} (free_range_of_untyped idx (bits_of a) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of a) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap a) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle b \<and> fst cref \<noteq> idle_thread b \<and> valid_etcbs b \<and> ptr && ~~ mask sz = ptr' \<and> cte_wp_at (\<lambda>_. True) cref b \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs b \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref b \<and> pspace_no_overlap (up_aligned_area ptr sz) b \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref b \<and> caps_no_overlap ptr sz b \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs b \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref b \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs b \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref b \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 a))) cref b \<and> idle_thread b \<notin> fst ` set slots \<and> untyped_is_device (transform_cap a) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x b) \<and> cte_wp_at (\<lambda>_. True) cref b) \<and> valid_etcbs b \<and> bits_of a = sz\<rbrace>
 2. \<lbrace>?Q5\<rbrace> whenE reset (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'15\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and ?Q5) sa
 5. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (4 subgoals):
 1. reset \<Longrightarrow> \<lbrace>?P'760\<rbrace> Untyped_D.reset_untyped_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>rv s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s\<rbrace>, -
 2. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr' \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> ?P'760 s else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (4 subgoals):
 1. reset \<Longrightarrow> \<lbrace>?P'760\<rbrace> Untyped_D.reset_untyped_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)\<rbrace>
 2. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr' \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> ?P'760 s else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (3 subgoals):
 1. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>x. valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr' \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 3. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (5 subgoals):
 1. \<lbrace>?Q'5\<rbrace> whenE reset (Retype_A.reset_untyped_cap cref) \<lbrace>\<lambda>_. valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s. (valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s)) s \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr' \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)) s
 3. \<And>e s. True \<Longrightarrow> True
 4. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 5. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and ?Q'5) sa proof (prove)
goal (5 subgoals):
 1. reset \<Longrightarrow> \<lbrace>?P'787\<rbrace> Retype_A.reset_untyped_cap cref \<lbrace>\<lambda>rv s. invs s \<and> valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) s \<and> ct_active s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s)\<rbrace>, -
 2. \<And>rv s. (valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s)) s \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr' \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)) s
 3. \<And>e s. True \<Longrightarrow> True
 4. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 5. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> ?P'787 s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (6 subgoals):
 1. \<And>rv s. \<lbrakk>reset; (invs and valid_untyped_inv_wcap ?ui796 (Some (cap.UntypedCap ?dev796 ?ptr796 ?sz796 0)) and ct_active and pspace_no_overlap {?ptr796..?ptr796 + 2 ^ ?sz796 - 1}) s\<rbrakk> \<Longrightarrow> invs s \<and> valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) s \<and> ct_active s \<and> (reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s)
 2. \<And>e s. \<lbrakk>reset; invs s\<rbrakk> \<Longrightarrow> True
 3. \<And>rv s. (valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s)) s \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr' \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)) s
 4. \<And>e s. True \<Longrightarrow> True
 5. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 6. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap ?ui796 (Some (cap.UntypedCap ?dev796 ?ptr796 ?sz796 ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. ?ui796 = untyped_invocation.Retype cref True ptr_base ptr' ty us slots ?dev796)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (5 subgoals):
 1. \<And>e s. \<lbrakk>reset; invs s\<rbrakk> \<Longrightarrow> True
 2. \<And>rv s. (valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s)) s \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr' \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)) s
 3. \<And>e s. True \<Longrightarrow> True
 4. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 5. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>rv s. (valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s)) s \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr' \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)) s
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>rv s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_untyped_inv_wcap (untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; valid_etcbs s; invs s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr && ~~ mask sz \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)) s
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>rv s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_untyped_inv_wcap (untyped_invocation.Retype cref reset (ptr && ~~ mask sz) ptr tp us slots dev) (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) cref s \<longrightarrow> (tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> range_cover ptr sz (obj_bits_api tp us) (length slots) \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> available_range (transform_cap cap) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (\<exists>idx. transform_cap cap = cdl_cap.UntypedCap dev {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ bits_of cap - 1} (free_range_of_untyped idx (bits_of cap) (ptr && ~~ mask sz))) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) (bits_of cap) (ptr && ~~ mask sz) \<subseteq> available_range (transform_cap cap) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> ptr && ~~ mask sz = ptr && ~~ mask sz \<and> cte_wp_at (\<lambda>_. True) cref s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> cte_wp_at (\<lambda>c. untyped_range c = {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) cref s \<and> caps_no_overlap ptr sz s \<and> free_index_of (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> invs s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) cref s \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> invs s \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> cte_wp_at ((=) (cap.UntypedCap dev (ptr && ~~ mask sz) sz (?idx731 cap))) cref s \<and> idle_thread s \<notin> fst ` set slots \<and> untyped_is_device (transform_cap cap) = dev \<and> (\<forall>x\<in>set slots. (if x = cref then False else cte_wp_at ((=) cap.NullCap) x s) \<and> cte_wp_at (\<lambda>_. True) cref s) \<and> valid_etcbs s \<and> bits_of cap = sz)) s
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread (fst cref) s \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> free_range_of_untyped (if reset then 0 else idx) sz (ptr && ~~ mask sz) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) sz (ptr && ~~ mask sz) \<subseteq> free_range_of_untyped (if reset then 0 else idx) sz (ptr && ~~ mask sz) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> ?idx731 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = (if reset then 0 else idx) \<and> idle_thread s \<notin> fst ` set slots \<and> (\<forall>x\<in>set slots. if x = cref then False else True)
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread (fst cref) s \<and> is_aligned ptr (obj_bits_api tp us) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> free_range_of_untyped (if reset then 0 else idx) sz (ptr && ~~ mask sz) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) sz (ptr && ~~ mask sz) \<subseteq> free_range_of_untyped (if reset then 0 else idx) sz (ptr && ~~ mask sz) - (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> ?idx731 (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = (if reset then 0 else idx) \<and> idle_thread s \<notin> fst ` set slots \<and> (\<forall>x\<in>set slots. if x = cref then False else True)
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread (fst cref) s \<and> is_aligned ptr (obj_bits_api tp us) \<and> (length slots \<noteq> 0 \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz)) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> is_aligned (ptr && ~~ mask sz) sz \<and> sz < size (ptr && ~~ mask sz)) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) sz (ptr && ~~ mask sz) \<inter> (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) = {}) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> True \<and> idle_thread s \<notin> fst ` set slots \<and> (\<forall>x\<in>set slots. if x = cref then False else True)
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> cap_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) = {}\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread (fst cref) s \<and> is_aligned ptr (obj_bits_api tp us) \<and> (length slots \<noteq> 0 \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz)) \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> valid_pspace s \<and> valid_idle s \<and> (((if reset then 0 else idx) \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<and> is_aligned (ptr && ~~ mask sz) sz \<and> sz < word_bits) \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) sz (ptr && ~~ mask sz) \<inter> (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) = {}) \<and> valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> caps_no_overlap ptr sz s \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {} \<and> descendants_range_in {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} cref s \<and> True \<and> idle_thread s \<notin> fst ` set slots \<and> (\<forall>x\<in>set slots. if x = cref then False else True)
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_pspace s \<and> sz < word_bits \<and> not_idle_thread (fst cref) s \<and> is_aligned ptr (obj_bits_api tp us) \<and> fst cref \<noteq> idle_thread s \<and> idle_thread s \<notin> fst ` set slots \<and> pspace_no_overlap (up_aligned_area ptr sz) s \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) \<and> unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)) \<le> 2 ^ sz \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> free_range_of_untyped (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz))) sz (ptr && ~~ mask sz) \<inter> (\<lambda>a. pick (retype_transform_obj_ref tp us a)) ` set (retype_addrs ptr tp (length slots) us) = {} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat (ptr + (word_of_nat (length slots) << obj_bits_api tp us) - (ptr && ~~ mask sz)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> not_idle_thread (fst cref) s \<and> is_aligned ptr (obj_bits_api tp us) \<and> fst cref \<noteq> idle_thread s \<and> idle_thread s \<notin> fst ` set slots \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))) \<and> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> is_aligned ptr (obj_bits_api tp us) \<and> fst cref \<noteq> idle_thread s \<and> idle_thread s \<notin> fst ` set slots \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> fst cref \<noteq> idle_thread s \<and> idle_thread s \<notin> fst ` set slots \<and> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s \<and> (\<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))) \<and> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (9 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> fst cref \<noteq> idle_thread s
 2. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> idle_thread s \<notin> fst ` set slots
 3. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s
 4. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 5. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 7. \<And>e s. True \<Longrightarrow> True
 8. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 9. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> idle_thread s \<notin> fst ` set slots
 2. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s
 3. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 4. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 6. \<And>e s. True \<Longrightarrow> True
 7. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 8. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s
 2. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 3. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 5. \<And>e s. True \<Longrightarrow> True
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; reset\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s
 2. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; \<not> reset\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s
 3. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 4. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 6. \<And>e s. True \<Longrightarrow> True
 7. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 8. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref True (ptr && ~~ mask sz) ptr tp us slots sz 0 dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz 0); range_cover ptr sz (obj_bits_api tp us) (length slots); CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; reset\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; \<not> reset\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s
 3. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 4. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 6. \<And>e s. True \<Longrightarrow> True
 7. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 8. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; \<not> reset\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} s
 2. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 3. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 5. \<And>e s. True \<Longrightarrow> True
 6. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 7. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us))
 2. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 4. \<And>e s. True \<Longrightarrow> True
 5. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 6. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 3. \<And>e s. True \<Longrightarrow> True
 4. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 5. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 3. \<And>e s. True \<Longrightarrow> True
 4. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 5. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; invoke_untyped_proofs s cref reset (ptr && ~~ mask sz) ptr tp us slots sz (if reset then 0 else idx) dev; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>reset \<longrightarrow> pspace_no_overlap {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} s; ct_active s; valid_etcbs s; invs s; caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz (if reset then 0 else idx)); range_cover ptr sz (obj_bits_api tp us) (length slots); \<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz); reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; cref \<notin> set slots; \<forall>slot\<in>set slots. ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> caps_of_state s slot = Some cap.NullCap \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp; global_refs s \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length slots) * 2 ^ obj_bits_api tp us))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}\<rbrakk> \<Longrightarrow> usable_untyped_range (cap.UntypedCap dev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + (word_of_nat (length slots) << obj_bits_api tp us)))) \<inter> {ptr..ptr + word_of_nat (length slots) * 2 ^ obj_bits_api tp us - 1} = {}
 2. \<And>e s. True \<Longrightarrow> True
 3. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 4. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (3 subgoals):
 1. \<And>e s. True \<Longrightarrow> True
 2. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 3. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa. transform s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> True) and (\<lambda>s. True \<and> (if reset then \<lambda>s. True \<and> True \<and> True \<and> True \<and> True \<and> True else (\<lambda>_. True) and (\<lambda>s. opt_cap (transform_cslot_ptr cref) s \<noteq> None \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True \<and> True)) s)) s)) sa
 2. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (1 subgoal):
 1. \<And>sa. s = sa \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (1 subgoal):
 1. \<And>sa. \<lbrakk>s = sa; valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. reset \<longrightarrow> (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s) and (if reset then \<lambda>s. True \<and> valid_etcbs s \<and> (invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) and ct_active and K (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) s else valid_etcbs and invs and valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev ptr' sz (if reset then 0 else idx))) and ct_active and (\<lambda>s. reset \<longrightarrow> pspace_no_overlap {ptr'..ptr' + 2 ^ sz - 1} s))) sa proof (prove)
goal (1 subgoal):
 1. valid_untyped_inv_wcap untyped_invocation (Some (case untyped_invocation of untyped_invocation.Retype slot reset ptr_base ptr ty us slots dev \<Rightarrow> cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s \<Longrightarrow> (reset \<longrightarrow> cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref s \<and> CSpaceAcc_A.descendants_of cref (cdt s) = {} \<and> valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz ?idx796)) s \<and> (\<exists>ptr_base ptr' ty us slots. untyped_invocation = untyped_invocation.Retype cref True ptr_base ptr' ty us slots dev)) \<and> (\<not> reset \<longrightarrow> valid_untyped_inv_wcap untyped_invocation (Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx)) s) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>caps_of_state s cref = Some (cap.UntypedCap dev (ptr && ~~ mask sz) sz idx); ptr' = ptr && ~~ mask sz; range_cover ptr sz (obj_bits_api tp us) (length slots); idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; reset \<longrightarrow> CSpaceAcc_A.descendants_of cref (cdt s) = {}; tp = CapTableObject \<longrightarrow> 0 < us; tp = apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; cref \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to Structures_A.is_cnode_cap slot s \<and> real_cte_at slot s; tp \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> tp = apiobject_type.Untyped \<or> is_frame_type tp\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> idx = ?idx796 \<and> (?idx796 \<le> unat (ptr && mask sz) \<or> ptr = ptr && ~~ mask sz)) \<and> (\<not> reset \<longrightarrow> idx \<le> unat (ptr && mask sz)) proof (prove)
goal:
No subgoals! proof (state)
this:
dcorres (dc \<oplus> dc) ((=) (transform s)) ((=) s) (Untyped_D.invoke_untyped (translate_untyped_invocation untyped_invocation)) (Retype_A.invoke_untyped untyped_invocation)

goal:
No subgoals!