theory Untyped_R

lemma decodeUntyped_wf[wp]:
  "\<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = UntypedCap d w sz idx) slot
          and sch_act_simple
          and (\<lambda>s. \<forall>x \<in> set cs. s \<turnstile>' x)
          and (\<lambda>s. \<forall>x \<in> set cs. \<forall>r \<in> cte_refs' x (irq_node' s). ex_cte_cap_to' r s)\<rbrace>
     decodeUntypedInvocation label args slot
       (UntypedCap d w sz idx) cs
   \<lbrace>valid_untyped_inv'\<rbrace>,-" unfolding decodeUntypedInvocation_def apply (simp add: unlessE_def[symmetric] unlessE_whenE rangeCheck_def whenE_def[symmetric]
                   returnOk_liftE[symmetric] Let_def cap_case_CNodeCap_True_throw
                split del: if_split cong: if_cong list.case_cong) apply (rule list_case_throw_validE_R) apply (clarsimp split del: if_split split: list.splits) apply (intro conjI impI allI) apply (wp+)[6] apply (clarsimp split del: if_split) apply (rename_tac ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs') apply (rule validE_R_sp[OF map_ensure_empty'] validE_R_sp[OF whenE_throwError_sp]
              validE_R_sp[OF dui_sp_helper'])+ apply (case_tac "\<not> isCNodeCap nodeCap") apply (simp add: validE_R_def) apply (simp add: mapM_locate_eq bind_liftE_distrib bindE_assoc returnOk_liftE[symmetric]) apply (rule validE_R_sp, rule liftE_validE_R, rule stateAssert_sp) apply (rule hoare_pre, wp whenE_throwError_wp checkFreeIndex_wp map_ensure_empty') apply (clarsimp simp:cte_wp_at_ctes_of not_less shiftL_nat) apply (case_tac cte) apply clarsimp apply (frule(1) valid_capAligned[OF ctes_of_valid_cap'[OF _ invs_valid_objs']]) apply (clarsimp simp:capAligned_def) apply (subgoal_tac "idx \<le> 2^ sz") prefer 2 apply (frule(1) ctes_of_valid_cap'[OF _ invs_valid_objs']) apply (clarsimp simp:valid_cap'_def valid_untyped_def) apply (subgoal_tac "(2 ^ sz - idx) < 2^ word_bits") prefer 2 apply (rule le_less_trans[where y = "2^sz"]; simp) apply (subgoal_tac "of_nat (2 ^ sz - idx) = (2::word32)^sz - of_nat idx") prefer 2 apply (simp add:word_of_nat_minus) apply (subgoal_tac "valid_cap' nodeCap s") prefer 2 apply (erule disjE) apply (fastforce dest: cte_wp_at_valid_objs_valid_cap') apply clarsimp apply (case_tac cte) apply clarsimp apply (drule(1) ctes_of_valid_cap'[OF _ invs_valid_objs'])+ apply simp apply (clarsimp simp: toEnum_of_nat [OF less_Suc_unat_less_bound]) apply (subgoal_tac "args ! 4 \<le> 2 ^ capCNodeBits nodeCap") prefer 2 apply (clarsimp simp: isCap_simps) apply (subst (asm) le_m1_iff_lt[THEN iffD1]) apply (clarsimp simp:valid_cap'_def isCap_simps p2_gt_0 capAligned_def word_bits_def) apply (rule less_imp_le) apply simp apply (subgoal_tac
    "distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2^cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])") prefer 2 apply (simp add: distinct_map upto_enum_def del: upt_Suc) apply (rule comp_inj_on) apply (rule inj_onI) apply (clarsimp dest!: less_Suc_unat_less_bound) apply (erule word_unat.Abs_eqD) apply (simp add: unats_def) apply (simp add: unats_def) apply (rule inj_onI) apply (clarsimp simp: toEnum_of_nat[OF less_Suc_unat_less_bound] isCap_simps) apply (erule(2) inj_bits, simp add: word_bits_def cte_level_bits_def) apply (subst Suc_unat_diff_1) apply (rule word_le_plus_either,simp) apply (subst olen_add_eqv) apply (subst add.commute) apply (erule(1) plus_minus_no_overflow_ab) apply (drule(1) le_plus) apply (rule unat_le_helper) apply (erule order_trans) apply (subst unat_power_lower32[symmetric], simp add: word_bits_def) apply (simp add: word_less_nat_alt[symmetric]) apply (rule two_power_increasing) apply (clarsimp dest!: valid_capAligned
                     simp: capAligned_def objBits_def objBitsKO_def) apply (simp_all add: word_bits_def objBits_defs cte_level_bits_def)[2] apply (clarsimp simp: ARM_H.fromAPIType_def) apply (subgoal_tac "Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)") prefer 2 apply simp apply (subst Suc_unat_diff_1) apply (rule word_le_plus_either,simp) apply (subst olen_add_eqv) apply (subst add.commute) apply (erule(1) plus_minus_no_overflow_ab) apply (rule unat_plus_simple[THEN iffD1]) apply (subst olen_add_eqv) apply (subst add.commute) apply (erule(1) plus_minus_no_overflow_ab) apply clarsimp apply (subgoal_tac "(\<forall>x. (args ! 4) \<le> x \<and> x \<le> (args ! 4) + (args ! 5) - 1 \<longrightarrow>
                      ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2^cteSizeBits) s)") prefer 2 apply clarsimp apply (erule disjE) apply (erule bspec) apply (clarsimp simp:isCap_simps image_def) apply (rule_tac x = x in bexI,simp) apply simp apply (erule order_trans) apply (frule(1) le_plus) apply (rule word_l_diffs,simp+) apply (rule word_le_plus_either,simp) apply (subst olen_add_eqv) apply (subst add.commute) apply (erule(1) plus_minus_no_overflow_ab) apply (clarsimp simp:ex_cte_cap_wp_to'_def) apply (rule_tac x = nodeSlot in exI) apply (case_tac cte) apply (clarsimp simp:cte_wp_at_ctes_of isCap_simps image_def) apply (rule_tac x = x in bexI,simp) apply simp apply (erule order_trans) apply (frule(1) le_plus) apply (rule word_l_diffs,simp+) apply (rule word_le_plus_either,simp) apply (subst olen_add_eqv) apply (subst add.commute) apply (erule(1) plus_minus_no_overflow_ab) apply (simp add: fromIntegral_def toInteger_nat fromInteger_nat) apply (rule conjI) apply (simp add: objBits_defs cte_level_bits_def) apply (clarsimp simp:of_nat_shiftR word_le_nat_alt) apply (frule_tac n = "unat (args ! 5)"
                and bits = "APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))"
                 in range_cover_stuff[where rv = 0,rotated -1]) apply (simp add:unat_1_0) apply simp apply (simp add:word_sub_le_iff word_of_nat_le) apply simp apply (clarsimp simp:getFreeRef_def) apply (frule alignUp_idem[OF is_aligned_weaken,where a = w]) apply (erule range_cover.sz) apply (simp add:range_cover_def) apply (simp add:empty_descendants_range_in') apply (clarsimp simp:image_def isCap_simps nullPointer_def word_size field_simps) apply (intro conjI) apply (clarsimp simp: image_def isCap_simps nullPointer_def word_size field_simps) apply (drule_tac x=x in spec)+ apply simp apply (clarsimp simp: APIType_capBits_def) apply clarsimp apply (clarsimp simp: image_def getFreeRef_def cte_level_bits_def objBits_simps' field_simps) apply (clarsimp simp: of_nat_shiftR word_le_nat_alt) apply (frule_tac n = "unat (args ! 5)"
            and bits = "(APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))"
             in range_cover_stuff[where w=w and sz=sz and rv = idx,rotated -1]; simp?) apply (intro conjI; clarsimp simp add: image_def word_size) apply (clarsimp simp: image_def isCap_simps nullPointer_def word_size field_simps) apply (drule_tac x=x in spec)+ apply simp apply (clarsimp simp: APIType_capBits_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> decodeUntypedInvocation label args slot (capability.UntypedCap d w sz idx) cs \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> case (args, cs) of ([], xa) \<Rightarrow> throw $ if genInvocationType label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation | ([newTypeW], xa) \<Rightarrow> throw $ if genInvocationType label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation | ([newTypeW, userObjSizeW], xa) \<Rightarrow> throw $ if genInvocationType label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation | ([newTypeW, userObjSizeW, nodeIndexW], xa) \<Rightarrow> throw $ if genInvocationType label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation | ([newTypeW, userObjSizeW, nodeIndexW, nodeDepthW], xa) \<Rightarrow> throw $ if genInvocationType label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation | ([newTypeW, userObjSizeW, nodeIndexW, nodeDepthW, nodeOffset], xa) \<Rightarrow> throw $ if genInvocationType label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation | (newTypeW # userObjSizeW # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # x, []) \<Rightarrow> throw $ if genInvocationType label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation | (newTypeW # userObjSizeW # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # x, rootCap # xaa) \<Rightarrow> doE unlessE (genInvocationType label = UntypedRetype) $ throw Fault_H.syscall_error.IllegalOperation;
whenE (fromEnum maxBound < fromIntegral newTypeW) $ throw $ Fault_H.syscall_error.InvalidArgument 0;
newType <- returnOk (toEnum (fromIntegral newTypeW));
userObjSize <- returnOk (fromIntegral userObjSizeW);
objectSize <- returnOk (getObjectSize newType userObjSize);
unlessE (userObjSize < wordBits) $ throw $ Fault_H.syscall_error.RangeError 0 $ fromIntegral maxUntypedSizeBits;
rangeCheck objectSize 0 maxUntypedSizeBits;
whenE (newType = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> userObjSize = 0) $ throw $ Fault_H.syscall_error.InvalidArgument 1;
whenE (newType = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> userObjSize < minUntypedSizeBits) $ throw $ Fault_H.syscall_error.InvalidArgument 1;
nodeIndex <- returnOk (CPtr nodeIndexW);
nodeDepth <- returnOk (fromIntegral nodeDepthW);
nodeCap <- if nodeDepth = 0 then returnOk rootCap else doE nodeSlot <- lookupTargetSlot rootCap nodeIndex nodeDepth;
withoutFailure $ getSlotCap nodeSlot
odE;
case nodeCap of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk () | _ \<Rightarrow> throw $ Fault_H.syscall_error.FailedLookup False $ Fault_H.lookup_failure.MissingCapability nodeDepth;
nodeSize <- returnOk (1 `~shiftL~` capCNodeBits nodeCap);
rangeCheck nodeOffset 0 $ nodeSize - 1;
rangeCheck nodeWindow 1 retypeFanOutLimit;
rangeCheck nodeWindow 1 $ nodeSize - nodeOffset;
slots <- withoutFailure $ mapM (locateSlotCap nodeCap) [nodeOffset .e. nodeOffset + nodeWindow - 1];
mapME_x ensureEmptySlot slots;
reset <- withoutFailure $ constOnFailure False $ doE ensureNoChildren slot;
returnOk True
odE;
freeIndex <- returnOk (if reset then 0 else capFreeIndex (capability.UntypedCap d w sz idx));
freeRef <- returnOk (getFreeRef (capPtr (capability.UntypedCap d w sz idx)) freeIndex);
untypedFreeBytes <- returnOk (HaskellLib_H.bit (capBlockSize (capability.UntypedCap d w sz idx)) - freeIndex);
maxCount <- returnOk (untypedFreeBytes `~shiftR~` objectSize);
whenE (fromIntegral maxCount < nodeWindow) $ throw $ Fault_H.syscall_error.NotEnoughMemory $ fromIntegral untypedFreeBytes;
notFrame <- returnOk (Not $ isFrameType newType);
isDevice <- returnOk (capIsDevice (capability.UntypedCap d w sz idx));
whenE (isDevice \<and> notFrame \<and> newType \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) $ throw $ Fault_H.syscall_error.InvalidArgument 1;
alignedFreeRef <- returnOk (PPtr $ Untyped_H.alignUp (fromPPtr freeRef) objectSize);
returnOk $ Invocations_H.untyped_invocation.Retype slot reset (capPtr (capability.UntypedCap d w sz idx)) alignedFreeRef newType userObjSize slots isDevice
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> case args of [] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW, userObjSizeW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW, userObjSizeW, nodeIndexW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW, userObjSizeW, nodeIndexW, nodeDepthW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [newTypeW, userObjSizeW, nodeIndexW, nodeDepthW, nodeOffset] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | newTypeW # userObjSizeW # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # x \<Rightarrow> case cs of [] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | rootCap # xa \<Rightarrow> doE y <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError Fault_H.syscall_error.IllegalOperation);
y <- whenE (fromEnum maxBound < unat newTypeW) (throwError (Fault_H.syscall_error.InvalidArgument 0));
y <- whenE (\<not> unat userObjSizeW < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
y <- whenE (\<not> APIType_capBits (toEnum (unat newTypeW)) (unat userObjSizeW) \<le> maxUntypedSizeBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
y <- whenE (toEnum (unat newTypeW) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat userObjSizeW = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat newTypeW) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat userObjSizeW < minUntypedSizeBits) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat nodeDepthW = 0 then returnOk rootCap else doE nodeSlot <- lookupTargetSlot rootCap nodeIndexW (unat nodeDepthW);
liftE (getSlotCap nodeSlot)
odE;
y <- whenE (\<not> isCNodeCap nodeCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat nodeDepthW))));
y <- whenE (\<not> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> retypeFanOutLimit) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - nodeOffset)));
slots <- liftE (mapM (locateSlotCap nodeCap) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat newTypeW)) (unat userObjSizeW))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat newTypeW)) \<and> toEnum (unat newTypeW) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat newTypeW)) (unat userObjSizeW))) (toEnum (unat newTypeW)) (unat userObjSizeW) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>y ys. args = y # ys \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> case ys of [] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [userObjSizeW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [userObjSizeW, nodeIndexW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [userObjSizeW, nodeIndexW, nodeDepthW] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | [userObjSizeW, nodeIndexW, nodeDepthW, nodeOffset] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | userObjSizeW # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # x \<Rightarrow> case cs of [] \<Rightarrow> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) | rootCap # xa \<Rightarrow> doE ya <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError Fault_H.syscall_error.IllegalOperation);
ya <- whenE (fromEnum maxBound < unat y) (throwError (Fault_H.syscall_error.InvalidArgument 0));
ya <- whenE (\<not> unat userObjSizeW < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (\<not> APIType_capBits (toEnum (unat y)) (unat userObjSizeW) \<le> maxUntypedSizeBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat userObjSizeW = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat userObjSizeW < minUntypedSizeBits) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat nodeDepthW = 0 then returnOk rootCap else doE nodeSlot <- lookupTargetSlot rootCap nodeIndexW (unat nodeDepthW);
liftE (getSlotCap nodeSlot)
odE;
ya <- whenE (\<not> isCNodeCap nodeCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat nodeDepthW))));
ya <- whenE (\<not> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
ya <- whenE (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> retypeFanOutLimit) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
ya <- whenE (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - nodeOffset)));
slots <- liftE (mapM (locateSlotCap nodeCap) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
ya <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
ya <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat userObjSizeW))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
ya <- whenE (d \<and> \<not> isFrameType (toEnum (unat y)) \<and> toEnum (unat y) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat userObjSizeW))) (toEnum (unat y)) (unat userObjSizeW) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>y ys. args = y # ys \<Longrightarrow> (ys = [] \<longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -) \<and> (\<forall>x21 x22. (x22 = [] \<longrightarrow> ys = [x21] \<longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -) \<and> (\<forall>x21a x22a. (x22a = [] \<longrightarrow> x22 = [x21a] \<longrightarrow> ys = [x21, x21a] \<longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -) \<and> (\<forall>x21b x22b. (x22b = [] \<longrightarrow> x22a = [x21b] \<longrightarrow> x22 = [x21a, x21b] \<longrightarrow> ys = [x21, x21a, x21b] \<longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -) \<and> (\<forall>x21c x22c. (x22c = [] \<longrightarrow> x22b = [x21c] \<longrightarrow> x22a = [x21b, x21c] \<longrightarrow> x22 = [x21a, x21b, x21c] \<longrightarrow> ys = [x21, x21a, x21b, x21c] \<longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -) \<and> (\<forall>x21d. (cs = [] \<longrightarrow> (\<forall>x22d. x22c = x21d # x22d \<longrightarrow> x22b = x21c # x21d # x22d \<longrightarrow> x22a = x21b # x21c # x21d # x22d \<longrightarrow> x22 = x21a # x21b # x21c # x21d # x22d \<longrightarrow> ys = x21 # x21a # x21b # x21c # x21d # x22d \<longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -)) \<and> (\<forall>x21e x22d. cs = x21e # x22d \<longrightarrow> (\<forall>x22e. x22c = x21d # x22e \<longrightarrow> x22b = x21c # x21d # x22e \<longrightarrow> x22a = x21b # x21c # x21d # x22e \<longrightarrow> x22 = x21a # x21b # x21c # x21d # x22e \<longrightarrow> ys = x21 # x21a # x21b # x21c # x21d # x22e \<longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. valid_cap' x21e s \<and> (\<forall>x\<in>set x22d. valid_cap' x s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' x21e (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set x22d. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))\<rbrace> doE ya <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError Fault_H.syscall_error.IllegalOperation);
ya <- whenE (fromEnum maxBound < unat y) (throwError (Fault_H.syscall_error.InvalidArgument 0));
ya <- whenE (\<not> unat x21 < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (\<not> APIType_capBits (toEnum (unat y)) (unat x21) \<le> maxUntypedSizeBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat x21 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat x21 < minUntypedSizeBits) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat x21b = 0 then returnOk x21e else doE nodeSlot <- lookupTargetSlot x21e x21a (unat x21b);
liftE (getSlotCap nodeSlot)
odE;
ya <- whenE (\<not> isCNodeCap nodeCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat x21b))));
ya <- whenE (\<not> x21c \<le> 2 ^ capCNodeBits nodeCap - 1) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
ya <- whenE (1 \<le> x21d \<longrightarrow> \<not> x21d \<le> retypeFanOutLimit) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
ya <- whenE (1 \<le> x21d \<longrightarrow> \<not> x21d \<le> 2 ^ capCNodeBits nodeCap - x21c) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - x21c)));
slots <- liftE (mapM (locateSlotCap nodeCap) [x21c .e. x21c + x21d - 1]);
ya <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
ya <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat x21))) < x21d) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
ya <- whenE (d \<and> \<not> isFrameType (toEnum (unat y)) \<and> toEnum (unat y) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat x21))) (toEnum (unat y)) (unat x21) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, -))))))) proof (prove)
goal (7 subgoals):
 1. \<And>y ys. \<lbrakk>args = y # ys; ys = []\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -
 2. \<And>y ys x21 x22. \<lbrakk>args = y # ys; x22 = []; ys = [x21]\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -
 3. \<And>y ys x21 x22 x21a x22a. \<lbrakk>args = y # ys; x22a = []; x22 = [x21a]; ys = [x21, x21a]\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -
 4. \<And>y ys x21 x22 x21a x22a x21b x22b. \<lbrakk>args = y # ys; x22b = []; x22a = [x21b]; x22 = [x21a, x21b]; ys = [x21, x21a, x21b]\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -
 5. \<And>y ys x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>args = y # ys; x22c = []; x22b = [x21c]; x22a = [x21b, x21c]; x22 = [x21a, x21b, x21c]; ys = [x21, x21a, x21b, x21c]\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. \<forall>x\<in>set cs. valid_cap' x s) and (\<lambda>s. \<forall>x\<in>set cs. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -
 6. \<And>y ys x21 x22 x21a x22a x21b x22b x21c x22c x21d x22d. \<lbrakk>args = y # ys; cs = []; x22c = x21d # x22d; x22b = x21c # x21d # x22d; x22a = x21b # x21c # x21d # x22d; x22 = x21a # x21b # x21c # x21d # x22d; ys = x21 # x21a # x21b # x21c # x21d # x22d\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple\<rbrace> throwError (if gen_invocation_type label = UntypedRetype then Fault_H.syscall_error.TruncatedMessage else Fault_H.syscall_error.IllegalOperation) \<lbrace>valid_untyped_inv'\<rbrace>, -
 7. \<And>y ys x21 x22 x21a x22a x21b x22b x21c x22c x21d x21e x22d x22e. \<lbrakk>args = y # ys; cs = x21e # x22d; x22c = x21d # x22e; x22b = x21c # x21d # x22e; x22a = x21b # x21c # x21d # x22e; x22 = x21a # x21b # x21c # x21d # x22e; ys = x21 # x21a # x21b # x21c # x21d # x22e\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. valid_cap' x21e s \<and> (\<forall>x\<in>set x22d. valid_cap' x s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' x21e (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set x22d. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))\<rbrace> doE ya <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError Fault_H.syscall_error.IllegalOperation);
ya <- whenE (fromEnum maxBound < unat y) (throwError (Fault_H.syscall_error.InvalidArgument 0));
ya <- whenE (\<not> unat x21 < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (\<not> APIType_capBits (toEnum (unat y)) (unat x21) \<le> maxUntypedSizeBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat x21 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat x21 < minUntypedSizeBits) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat x21b = 0 then returnOk x21e else doE nodeSlot <- lookupTargetSlot x21e x21a (unat x21b);
liftE (getSlotCap nodeSlot)
odE;
ya <- whenE (\<not> isCNodeCap nodeCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat x21b))));
ya <- whenE (\<not> x21c \<le> 2 ^ capCNodeBits nodeCap - 1) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
ya <- whenE (1 \<le> x21d \<longrightarrow> \<not> x21d \<le> retypeFanOutLimit) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
ya <- whenE (1 \<le> x21d \<longrightarrow> \<not> x21d \<le> 2 ^ capCNodeBits nodeCap - x21c) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - x21c)));
slots <- liftE (mapM (locateSlotCap nodeCap) [x21c .e. x21c + x21d - 1]);
ya <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
ya <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat x21))) < x21d) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
ya <- whenE (d \<and> \<not> isFrameType (toEnum (unat y)) \<and> toEnum (unat y) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat x21))) (toEnum (unat y)) (unat x21) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>y ys x21 x22 x21a x22a x21b x22b x21c x22c x21d x21e x22d x22e. \<lbrakk>args = y # ys; cs = x21e # x22d; x22c = x21d # x22e; x22b = x21c # x21d # x22e; x22a = x21b # x21c # x21d # x22e; x22 = x21a # x21b # x21c # x21d # x22e; ys = x21 # x21a # x21b # x21c # x21d # x22e\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. valid_cap' x21e s \<and> (\<forall>x\<in>set x22d. valid_cap' x s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' x21e (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set x22d. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))\<rbrace> doE ya <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError Fault_H.syscall_error.IllegalOperation);
ya <- whenE (fromEnum maxBound < unat y) (throwError (Fault_H.syscall_error.InvalidArgument 0));
ya <- whenE (\<not> unat x21 < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (\<not> APIType_capBits (toEnum (unat y)) (unat x21) \<le> maxUntypedSizeBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat x21 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat x21 < minUntypedSizeBits) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat x21b = 0 then returnOk x21e else doE nodeSlot <- lookupTargetSlot x21e x21a (unat x21b);
liftE (getSlotCap nodeSlot)
odE;
ya <- whenE (\<not> isCNodeCap nodeCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat x21b))));
ya <- whenE (\<not> x21c \<le> 2 ^ capCNodeBits nodeCap - 1) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
ya <- whenE (1 \<le> x21d \<longrightarrow> \<not> x21d \<le> retypeFanOutLimit) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
ya <- whenE (1 \<le> x21d \<longrightarrow> \<not> x21d \<le> 2 ^ capCNodeBits nodeCap - x21c) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - x21c)));
slots <- liftE (mapM (locateSlotCap nodeCap) [x21c .e. x21c + x21d - 1]);
ya <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
ya <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat x21))) < x21d) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
ya <- whenE (d \<and> \<not> isFrameType (toEnum (unat y)) \<and> toEnum (unat y) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat x21))) (toEnum (unat y)) (unat x21) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>y x21 x21a x21b x21c x21d x21e x22d x22e. \<lbrakk>args = y # x21 # x21a # x21b # x21c # x21d # x22e; cs = x21e # x22d\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. valid_cap' x21e s \<and> (\<forall>x\<in>set x22d. valid_cap' x s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' x21e (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set x22d. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))\<rbrace> doE ya <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError Fault_H.syscall_error.IllegalOperation);
ya <- whenE (fromEnum maxBound < unat y) (throwError (Fault_H.syscall_error.InvalidArgument 0));
ya <- whenE (\<not> unat x21 < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (\<not> APIType_capBits (toEnum (unat y)) (unat x21) \<le> maxUntypedSizeBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat x21 = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
ya <- whenE (toEnum (unat y) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat x21 < minUntypedSizeBits) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat x21b = 0 then returnOk x21e else doE nodeSlot <- lookupTargetSlot x21e x21a (unat x21b);
liftE (getSlotCap nodeSlot)
odE;
ya <- whenE (\<not> isCNodeCap nodeCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat x21b))));
ya <- whenE (\<not> x21c \<le> 2 ^ capCNodeBits nodeCap - 1) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
ya <- whenE (1 \<le> x21d \<longrightarrow> \<not> x21d \<le> retypeFanOutLimit) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
ya <- whenE (1 \<le> x21d \<longrightarrow> \<not> x21d \<le> 2 ^ capCNodeBits nodeCap - x21c) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - x21c)));
slots <- liftE (mapM (locateSlotCap nodeCap) [x21c .e. x21c + x21d - 1]);
ya <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
ya <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat x21))) < x21d) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
ya <- whenE (d \<and> \<not> isFrameType (toEnum (unat y)) \<and> toEnum (unat y) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat y)) (unat x21))) (toEnum (unat y)) (unat x21) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs'. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'\<rbrakk> \<Longrightarrow> \<lbrace>invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. valid_cap' rootCap s \<and> (\<forall>x\<in>set cs'. valid_cap' x s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))\<rbrace> doE y <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError Fault_H.syscall_error.IllegalOperation);
y <- whenE (fromEnum maxBound < unat ty) (throwError (Fault_H.syscall_error.InvalidArgument 0));
y <- whenE (\<not> unat us < wordBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
y <- whenE (\<not> APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits) (throwError (Fault_H.syscall_error.RangeError 0 (word_of_nat maxUntypedSizeBits)));
y <- whenE (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat us = 0) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
y <- whenE (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat us < minUntypedSizeBits) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
nodeCap <- if unat nodeDepthW = 0 then returnOk rootCap else doE nodeSlot <- lookupTargetSlot rootCap nodeIndexW (unat nodeDepthW);
liftE (getSlotCap nodeSlot)
odE;
y <- whenE (\<not> isCNodeCap nodeCap) (throwError (Fault_H.syscall_error.FailedLookup False (Fault_H.lookup_failure.MissingCapability (unat nodeDepthW))));
y <- whenE (\<not> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1) (throwError (Fault_H.syscall_error.RangeError 0 (2 ^ capCNodeBits nodeCap - 1)));
y <- whenE (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> retypeFanOutLimit) (throwError (Fault_H.syscall_error.RangeError 1 retypeFanOutLimit));
y <- whenE (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset) (throwError (Fault_H.syscall_error.RangeError 1 (2 ^ capCNodeBits nodeCap - nodeOffset)));
slots <- liftE (mapM (locateSlotCap nodeCap) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat ty)) \<and> toEnum (unat ty) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) (toEnum (unat ty)) (unat us) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' y ya yb yc yd ye nodeCap yf yg yh yi. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<not> (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset) \<and> \<not> (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> retypeFanOutLimit) \<and> \<not> \<not> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1 \<and> \<not> \<not> isCNodeCap nodeCap \<and> (nodeCap = rootCap \<or> (\<exists>nodeSlot. cte_wp_at' ((=) nodeCap \<circ> cteCap) nodeSlot s)) \<and> \<not> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat us < minUntypedSizeBits) \<and> \<not> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat us = 0) \<and> \<not> \<not> APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits \<and> \<not> \<not> unat us < wordBits \<and> \<not> fromEnum maxBound < unat ty \<and> \<not> gen_invocation_type label \<noteq> UntypedRetype \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. valid_cap' rootCap s \<and> (\<forall>x\<in>set cs'. valid_cap' x s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrace> doE slots <- liftE (mapM (locateSlotCap nodeCap) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat ty)) \<and> toEnum (unat ty) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) (toEnum (unat ty)) (unat us) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' y ya yb yc yd ye nodeCap yf yg yh yi. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; \<not> isCNodeCap nodeCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<not> (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset) \<and> \<not> (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> retypeFanOutLimit) \<and> \<not> \<not> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1 \<and> \<not> \<not> isCNodeCap nodeCap \<and> (nodeCap = rootCap \<or> (\<exists>nodeSlot. cte_wp_at' ((=) nodeCap \<circ> cteCap) nodeSlot s)) \<and> \<not> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat us < minUntypedSizeBits) \<and> \<not> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat us = 0) \<and> \<not> \<not> APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits \<and> \<not> \<not> unat us < wordBits \<and> \<not> fromEnum maxBound < unat ty \<and> \<not> gen_invocation_type label \<noteq> UntypedRetype \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. valid_cap' rootCap s \<and> (\<forall>x\<in>set cs'. valid_cap' x s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrace> doE slots <- liftE (mapM (locateSlotCap nodeCap) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat ty)) \<and> toEnum (unat ty) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) (toEnum (unat ty)) (unat us) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, -
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' y ya yb yc yd ye nodeCap yf yg yh yi. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; \<not> \<not> isCNodeCap nodeCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<not> (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset) \<and> \<not> (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> retypeFanOutLimit) \<and> \<not> \<not> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1 \<and> \<not> \<not> isCNodeCap nodeCap \<and> (nodeCap = rootCap \<or> (\<exists>nodeSlot. cte_wp_at' ((=) nodeCap \<circ> cteCap) nodeSlot s)) \<and> \<not> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat us < minUntypedSizeBits) \<and> \<not> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat us = 0) \<and> \<not> \<not> APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits \<and> \<not> \<not> unat us < wordBits \<and> \<not> fromEnum maxBound < unat ty \<and> \<not> gen_invocation_type label \<noteq> UntypedRetype \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. valid_cap' rootCap s \<and> (\<forall>x\<in>set cs'. valid_cap' x s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrace> doE slots <- liftE (mapM (locateSlotCap nodeCap) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat ty)) \<and> toEnum (unat ty) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) (toEnum (unat ty)) (unat us) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' y ya yb yc yd ye nodeCap yf yg yh yi. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; \<not> \<not> isCNodeCap nodeCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<not> (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset) \<and> \<not> (1 \<le> nodeWindow \<longrightarrow> \<not> nodeWindow \<le> retypeFanOutLimit) \<and> \<not> \<not> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1 \<and> \<not> \<not> isCNodeCap nodeCap \<and> (nodeCap = rootCap \<or> (\<exists>nodeSlot. cte_wp_at' ((=) nodeCap \<circ> cteCap) nodeSlot s)) \<and> \<not> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<and> unat us < minUntypedSizeBits) \<and> \<not> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<and> unat us = 0) \<and> \<not> \<not> APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits \<and> \<not> \<not> unat us < wordBits \<and> \<not> fromEnum maxBound < unat ty \<and> \<not> gen_invocation_type label \<noteq> UntypedRetype \<and> (invs' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot and sch_act_simple and (\<lambda>s. valid_cap' rootCap s \<and> (\<forall>x\<in>set cs'. valid_cap' x s)) and (\<lambda>s. (\<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s))) s\<rbrace> doE slots <- liftE (mapM (locateSlotCap nodeCap) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
y <- mapME_x ensureEmptySlot slots;
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat ty)) \<and> toEnum (unat ty) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) (toEnum (unat ty)) (unat us) slots d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. 1 \<le> nodeWindow \<and> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset \<and> 1 \<le> nodeWindow \<and> nodeWindow \<le> retypeFanOutLimit \<and> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1 \<and> (nodeCap = rootCap \<or> (\<exists>nodeSlot. cte_wp_at' ((=) nodeCap \<circ> cteCap) nodeSlot s)) \<and> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat us < minUntypedSizeBits) \<and> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits \<and> unat us < wordBits \<and> \<not> fromEnum maxBound < unat ty \<and> gen_invocation_type label = UntypedRetype \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot s \<and> sch_act_simple s \<and> valid_cap' rootCap s \<and> (\<forall>x\<in>set cs'. valid_cap' x s) \<and> (\<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)\<rbrace> doE x <- liftE (stateAssert (\<lambda>s. case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n) []);
y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat ty)) \<and> toEnum (unat ty) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) (toEnum (unat ty)) (unat us) (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. 1 \<le> nodeWindow \<and> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset \<and> 1 \<le> nodeWindow \<and> nodeWindow \<le> retypeFanOutLimit \<and> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1 \<and> (nodeCap = rootCap \<or> (\<exists>nodeSlot. cte_wp_at' ((=) nodeCap \<circ> cteCap) nodeSlot s)) \<and> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat us < minUntypedSizeBits) \<and> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits \<and> unat us < wordBits \<and> \<not> fromEnum maxBound < unat ty \<and> gen_invocation_type label = UntypedRetype \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot s \<and> sch_act_simple s \<and> valid_cap' rootCap s \<and> (\<forall>x\<in>set cs'. valid_cap' x s) \<and> (\<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) and (\<lambda>s. case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n)\<rbrace> doE y <- mapME_x ensureEmptySlot (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]);
reset <- liftE (constOnFailure False (doE y <- ensureNoChildren slot;
returnOk True
odE));
y <- whenE (word_of_nat (shiftR (shiftL (Suc 0) sz - (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) < nodeWindow) (throwError (Fault_H.syscall_error.NotEnoughMemory (word_of_nat (shiftL (Suc 0) sz - (if reset then 0 else idx)))));
y <- whenE (d \<and> \<not> isFrameType (toEnum (unat ty)) \<and> toEnum (unat ty) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) (throwError (Fault_H.syscall_error.InvalidArgument (Suc 0)));
returnOk (Invocations_H.untyped_invocation.Retype slot reset w (More_Word_Operations.alignUp (getFreeRef w (if reset then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) (toEnum (unat ty)) (unat us) (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) d)
odE \<lbrace>valid_untyped_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap x s. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; ((\<lambda>s. 1 \<le> nodeWindow \<and> nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset \<and> 1 \<le> nodeWindow \<and> nodeWindow \<le> retypeFanOutLimit \<and> nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1 \<and> (nodeCap = rootCap \<or> (\<exists>nodeSlot. cte_wp_at' ((=) nodeCap \<circ> cteCap) nodeSlot s)) \<and> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> \<not> unat us < minUntypedSizeBits) \<and> (toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits \<and> unat us < wordBits \<and> \<not> fromEnum maxBound < unat ty \<and> gen_invocation_type label = UntypedRetype \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d w sz idx) slot s \<and> sch_act_simple s \<and> valid_cap' rootCap s \<and> (\<forall>x\<in>set cs'. valid_cap' x s) \<and> (\<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s)) and (\<lambda>s. case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n)) s\<rbrakk> \<Longrightarrow> True \<and> ((\<forall>slot\<in>set (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) slot s) \<longrightarrow> True \<and> (if descendants_of' slot (ctes_of s) = {} then \<not> word_of_nat (shiftR (shiftL (Suc 0) sz - (if True then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) < nodeWindow \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat ty)) \<and> toEnum (unat ty) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> valid_untyped_inv' (Invocations_H.untyped_invocation.Retype slot True w (More_Word_Operations.alignUp (getFreeRef w (if True then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) (toEnum (unat ty)) (unat us) (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) d) s else \<not> word_of_nat (shiftR (shiftL (Suc 0) sz - (if False then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) < nodeWindow \<longrightarrow> \<not> (d \<and> \<not> isFrameType (toEnum (unat ty)) \<and> toEnum (unat ty) \<noteq> fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> valid_untyped_inv' (Invocations_H.untyped_invocation.Retype slot False w (More_Word_Operations.alignUp (getFreeRef w (if False then 0 else idx)) (APIType_capBits (toEnum (unat ty)) (unat us))) (toEnum (unat ty)) (unat us) (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) d) s)) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s cte. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cteCap cte = capability.UntypedCap d w sz idx; valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s cte x1 x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cteCap cte = capability.UntypedCap d w sz idx; valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; capAligned (capability.UntypedCap d w sz idx)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits\<rbrakk> \<Longrightarrow> idx \<le> 2 ^ sz proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits\<rbrakk> \<Longrightarrow> idx \<le> 2 ^ sz
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; valid_cap' (capability.UntypedCap d w sz idx) s\<rbrakk> \<Longrightarrow> idx \<le> 2 ^ sz
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz\<rbrakk> \<Longrightarrow> 2 ^ sz - idx < 2 ^ word_bits proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz\<rbrakk> \<Longrightarrow> 2 ^ sz - idx < 2 ^ word_bits
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits\<rbrakk> \<Longrightarrow> word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits\<rbrakk> \<Longrightarrow> word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx\<rbrakk> \<Longrightarrow> valid_cap' nodeCap s proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx\<rbrakk> \<Longrightarrow> valid_cap' nodeCap s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; nodeCap = rootCap\<rbrakk> \<Longrightarrow> valid_cap' nodeCap s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> valid_cap' nodeCap s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> valid_cap' nodeCap s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 nodeSlot cte. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap (cteCap cte); nodeWindow \<le> 2 ^ capCNodeBits (cteCap cte) - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits (cteCap cte) - 1; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr (cteCap cte)) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits (cteCap cte) \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; ctes_of s nodeSlot = Some cte\<rbrakk> \<Longrightarrow> valid_cap' (cteCap cte) s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 nodeSlot cte x1 x2a. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap (cteCap cte); nodeWindow \<le> 2 ^ capCNodeBits (cteCap cte) - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits (cteCap cte) - 1; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr (cteCap cte)) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits (cteCap cte) \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; ctes_of s nodeSlot = Some cte; cte = CTE x1 x2a\<rbrakk> \<Longrightarrow> valid_cap' (cteCap cte) s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 nodeSlot x1 x2a. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap x1; nodeWindow \<le> 2 ^ capCNodeBits x1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits x1 - 1; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr x1) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits x1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; ctes_of s nodeSlot = Some (CTE x1 x2a)\<rbrakk> \<Longrightarrow> valid_cap' x1 s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 nodeSlot x1 x2a. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap x1; nodeWindow \<le> 2 ^ capCNodeBits x1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits x1 - 1; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr x1) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits x1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.UntypedCap d w sz idx) s; valid_cap' x1 s\<rbrakk> \<Longrightarrow> valid_cap' x1 s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; word_of_nat (2 ^ sz - idx) = 2 ^ sz - word_of_nat idx; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> args ! 4 \<le> 2 ^ capCNodeBits nodeCap proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s\<rbrakk> \<Longrightarrow> args ! 4 \<le> 2 ^ capCNodeBits nodeCap
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s\<rbrakk> \<Longrightarrow> nodeOffset \<le> 2 ^ v1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit\<rbrakk> \<Longrightarrow> 0 < 2 ^ v1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset < 2 ^ v1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s\<rbrakk> \<Longrightarrow> nodeOffset \<le> 2 ^ v1
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset < 2 ^ v1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s\<rbrakk> \<Longrightarrow> nodeOffset \<le> 2 ^ v1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset < 2 ^ v1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s\<rbrakk> \<Longrightarrow> nodeOffset < 2 ^ v1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1]) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> inj_on ((\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) \<circ> toEnum) {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))}
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> inj_on toEnum {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))}
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> inj_on (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) (toEnum ` {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))})
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x y. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; x \<in> {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))}; y \<in> {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))}; toEnum x = toEnum y\<rbrakk> \<Longrightarrow> x = y
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> inj_on (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) (toEnum ` {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))})
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x y. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; word_of_nat x = word_of_nat y; unat nodeOffset \<le> x; x < 4294967296; unat nodeOffset \<le> y; y < 4294967296\<rbrakk> \<Longrightarrow> x = y
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> inj_on (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) (toEnum ` {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))})
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (4 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x y. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; unat nodeOffset \<le> x; x < 4294967296; unat nodeOffset \<le> y; y < 4294967296\<rbrakk> \<Longrightarrow> x \<in> unats LENGTH(32)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x y. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; unat nodeOffset \<le> x; x < 4294967296; unat nodeOffset \<le> y; y < 4294967296\<rbrakk> \<Longrightarrow> y \<in> unats LENGTH(32)
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> inj_on (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) (toEnum ` {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))})
 4. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x y. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; unat nodeOffset \<le> x; x < 4294967296; unat nodeOffset \<le> y; y < 4294967296\<rbrakk> \<Longrightarrow> y \<in> unats LENGTH(32)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> inj_on (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) (toEnum ` {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))})
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap\<rbrakk> \<Longrightarrow> inj_on (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) (toEnum ` {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))})
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x y. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> unat nodeOffset | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; x \<in> toEnum ` {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))}; y \<in> toEnum ` {unat nodeOffset..<Suc (unat (nodeOffset + nodeWindow - 1))}; capCNodePtr nodeCap + x * 2 ^ cte_level_bits = capCNodePtr nodeCap + y * 2 ^ cte_level_bits\<rbrakk> \<Longrightarrow> x = y
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; word_of_nat xa * 2 ^ cte_level_bits = word_of_nat xb * 2 ^ cte_level_bits; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> word_of_nat xa = word_of_nat xb
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) \<le> 2 ^ (word_bits - cte_level_bits)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> 1 \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) \<le> 2 ^ (word_bits - cte_level_bits)
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> nodeOffset \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) \<le> 2 ^ (word_bits - cte_level_bits)
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) \<le> 2 ^ (word_bits - cte_level_bits)
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeWindow + nodeOffset
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) \<le> 2 ^ (word_bits - cte_level_bits)
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) \<le> 2 ^ (word_bits - cte_level_bits)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1)); nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) \<le> 2 ^ (word_bits - cte_level_bits)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1)); nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> nodeOffset + nodeWindow \<le> word_of_nat (2 ^ (word_bits - cte_level_bits))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> 2 ^ v1 \<le> word_of_nat (2 ^ (word_bits - cte_level_bits))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> 2 ^ v1 \<le> word_of_nat (unat (2 ^ (word_bits - cte_level_bits)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> 2 ^ v1 \<le> 2 ^ (word_bits - cte_level_bits)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> v1 \<le> word_bits - cte_level_bits
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> word_bits - cte_level_bits < LENGTH(32)
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset < 2 ^ v1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1)); is_aligned (global.capUntypedPtr rootCap) (capBits rootCap); capBits rootCap < word_bits; is_aligned v0 (cteSizeBits + v1); cteSizeBits + v1 < word_bits\<rbrakk> \<Longrightarrow> v1 \<le> word_bits - cte_level_bits
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 xa xb v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> False | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; unat nodeOffset \<le> xa; xa < Suc (unat (nodeOffset + nodeWindow - 1)); unat nodeOffset \<le> xb; xb < Suc (unat (nodeOffset + nodeWindow - 1))\<rbrakk> \<Longrightarrow> word_bits - cte_level_bits < LENGTH(32)
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; args ! 4 \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [args ! 4 .e. args ! 4 + args ! 5 - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = fromAPIType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us \<and> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> 1 \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) = unat nodeOffset + unat nodeWindow
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> nodeOffset \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) = unat nodeOffset + unat nodeWindow
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) = unat nodeOffset + unat nodeWindow
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeWindow + nodeOffset
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) = unat nodeOffset + unat nodeWindow
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> unat (nodeOffset + nodeWindow) = unat nodeOffset + unat nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> nodeOffset \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1])\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeWindow + nodeOffset
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (args ! 4 + args ! 5 - 1)) = unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (Suc (unat (nodeOffset + nodeWindow - 1)) - unat nodeOffset) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> unat nodeOffset < Suc (unat (nodeOffset + nodeWindow - 1)) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow\<rbrakk> \<Longrightarrow> \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow\<rbrakk> \<Longrightarrow> \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; nodeCap = rootCap\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; nodeCap = rootCap\<rbrakk> \<Longrightarrow> capCNodePtr nodeCap + x * 2 ^ cteSizeBits \<in> cte_refs' rootCap (irq_node' s)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = capability.CNodeCap v0 v1 v2 v3 # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1\<rbrakk> \<Longrightarrow> \<exists>xa\<in>{0..2 ^ v1 - 1}. x * 2 ^ cteSizeBits = xa * 2 ^ cteSizeBits
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = capability.CNodeCap v0 v1 v2 v3 # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1\<rbrakk> \<Longrightarrow> x \<in> {0..2 ^ v1 - 1}
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = capability.CNodeCap v0 v1 v2 v3 # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1\<rbrakk> \<Longrightarrow> x \<le> 2 ^ v1 - 1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = capability.CNodeCap v0 v1 v2 v3 # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x\<rbrakk> \<Longrightarrow> nodeOffset + nodeWindow - 1 \<le> 2 ^ v1 - 1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = capability.CNodeCap v0 v1 v2 v3 # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> nodeOffset + nodeWindow - 1 \<le> 2 ^ v1 - 1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = capability.CNodeCap v0 v1 v2 v3 # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> 1 \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = capability.CNodeCap v0 v1 v2 v3 # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> nodeOffset \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = capability.CNodeCap v0 v1 v2 v3 # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = capability.CNodeCap v0 v1 v2 v3 # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeWindow + nodeOffset
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; \<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot cte. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap (cteCap cte); nodeWindow \<le> 2 ^ capCNodeBits (cteCap cte) - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits (cteCap cte) - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref. cte_wp_at' (\<lambda>c. r \<in> cte_refs' (cteCap c) (irq_node' s)) cref s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref. cte_wp_at' (\<lambda>c. r \<in> cte_refs' (cteCap c) (irq_node' s)) cref s; case gsCNodes s (global.capUntypedPtr (cteCap cte)) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits (cteCap cte) \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (cteCap cte) s; nodeOffset \<le> 2 ^ capCNodeBits (cteCap cte); distinct (map (\<lambda>y. capCNodePtr (cteCap cte) + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; ctes_of s nodeSlot = Some cte\<rbrakk> \<Longrightarrow> \<exists>cref. cte_wp_at' (\<lambda>c. capCNodePtr (cteCap cte) + x * 2 ^ cteSizeBits \<in> cte_refs' (cteCap c) (irq_node' s)) cref s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot cte. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap (cteCap cte); nodeWindow \<le> 2 ^ capCNodeBits (cteCap cte) - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits (cteCap cte) - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref. cte_wp_at' (\<lambda>c. r \<in> cte_refs' (cteCap c) (irq_node' s)) cref s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref. cte_wp_at' (\<lambda>c. r \<in> cte_refs' (cteCap c) (irq_node' s)) cref s; case gsCNodes s (global.capUntypedPtr (cteCap cte)) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits (cteCap cte) \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (cteCap cte) s; nodeOffset \<le> 2 ^ capCNodeBits (cteCap cte); distinct (map (\<lambda>y. capCNodePtr (cteCap cte) + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; ctes_of s nodeSlot = Some cte\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. capCNodePtr (cteCap cte) + x * 2 ^ cteSizeBits \<in> cte_refs' (cteCap c) (irq_node' s)) nodeSlot s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot cte x1 x2a. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap (cteCap cte); nodeWindow \<le> 2 ^ capCNodeBits (cteCap cte) - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits (cteCap cte) - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref. cte_wp_at' (\<lambda>c. r \<in> cte_refs' (cteCap c) (irq_node' s)) cref s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref. cte_wp_at' (\<lambda>c. r \<in> cte_refs' (cteCap c) (irq_node' s)) cref s; case gsCNodes s (global.capUntypedPtr (cteCap cte)) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits (cteCap cte) \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (cteCap cte) s; nodeOffset \<le> 2 ^ capCNodeBits (cteCap cte); distinct (map (\<lambda>y. capCNodePtr (cteCap cte) + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; ctes_of s nodeSlot = Some cte; cte = CTE x1 x2a\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. capCNodePtr (cteCap cte) + x * 2 ^ cteSizeBits \<in> cte_refs' (cteCap c) (irq_node' s)) nodeSlot s
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot x2a v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; ctes_of s nodeSlot = Some (CTE (capability.CNodeCap v0 v1 v2 v3) x2a)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>{0..2 ^ v1 - 1}. x * 2 ^ cteSizeBits = xa * 2 ^ cteSizeBits
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot x2a v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; ctes_of s nodeSlot = Some (CTE (capability.CNodeCap v0 v1 v2 v3) x2a)\<rbrakk> \<Longrightarrow> x \<in> {0..2 ^ v1 - 1}
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot x2a v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; x \<le> nodeOffset + nodeWindow - 1; ctes_of s nodeSlot = Some (CTE (capability.CNodeCap v0 v1 v2 v3) x2a)\<rbrakk> \<Longrightarrow> x \<le> 2 ^ v1 - 1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot x2a v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; ctes_of s nodeSlot = Some (CTE (capability.CNodeCap v0 v1 v2 v3) x2a)\<rbrakk> \<Longrightarrow> nodeOffset + nodeWindow - 1 \<le> 2 ^ v1 - 1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot x2a v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; ctes_of s nodeSlot = Some (CTE (capability.CNodeCap v0 v1 v2 v3) x2a); nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> nodeOffset + nodeWindow - 1 \<le> 2 ^ v1 - 1
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot x2a v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; ctes_of s nodeSlot = Some (CTE (capability.CNodeCap v0 v1 v2 v3) x2a); nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> 1 \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot x2a v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; ctes_of s nodeSlot = Some (CTE (capability.CNodeCap v0 v1 v2 v3) x2a); nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> nodeOffset \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot x2a v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; ctes_of s nodeSlot = Some (CTE (capability.CNodeCap v0 v1 v2 v3) x2a); nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeOffset + nodeWindow
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x nodeSlot x2a v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; nodeWindow \<le> 2 ^ v1 - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ v1 - 1; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s); case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; nodeOffset \<le> 2 ^ v1; distinct (map (\<lambda>y. v0 + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; nodeOffset \<le> x; ctes_of s nodeSlot = Some (CTE (capability.CNodeCap v0 v1 v2 v3) x2a); nodeOffset + nodeWindow \<le> 2 ^ v1\<rbrakk> \<Longrightarrow> nodeWindow \<le> nodeWindow + nodeOffset
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. args ! 4 \<le> x \<and> x \<le> args ! 4 + args ! 5 - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) \<and> (descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) = {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (6 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> 0 < unat (args ! 5)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat 0 >> APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> 0 \<le> 2 ^ sz
 4. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> sz < word_bits
 5. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; 0 \<le> unat (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) - w) \<and> More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) && ~~ mask sz = w \<and> range_cover (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))) sz (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) (unat (args ! 5))\<rbrakk> \<Longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 6. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (5 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat 0 >> APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> 0 \<le> 2 ^ sz
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> sz < word_bits
 4. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; 0 \<le> unat (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) - w) \<and> More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) && ~~ mask sz = w \<and> range_cover (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))) sz (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) (unat (args ! 5))\<rbrakk> \<Longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 5. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (4 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> 0 \<le> 2 ^ sz
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> sz < word_bits
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; 0 \<le> unat (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) - w) \<and> More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) && ~~ mask sz = w \<and> range_cover (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))) sz (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) (unat (args ! 5))\<rbrakk> \<Longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 4. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> sz < word_bits
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; 0 \<le> unat (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) - w) \<and> More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) && ~~ mask sz = w \<and> range_cover (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))) sz (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) (unat (args ! 5))\<rbrakk> \<Longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; 0 \<le> unat (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) - w) \<and> More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) && ~~ mask sz = w \<and> range_cover (More_Word_Operations.alignUp (w + word_of_nat 0) (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1)))) sz (APIType_capBits (toEnum (unat (args ! 0))) (unat (args ! 1))) (unat (args ! 5))\<rbrakk> \<Longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> More_Word_Operations.alignUp (getFreeRef w 0) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow)\<rbrakk> \<Longrightarrow> More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (4 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow)\<rbrakk> \<Longrightarrow> ?n548 ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 \<le> sz
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow)\<rbrakk> \<Longrightarrow> ?n548 ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 < LENGTH(32)
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (?n548 ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2) = w\<rbrakk> \<Longrightarrow> More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 4. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow)\<rbrakk> \<Longrightarrow> APIType_capBits (toEnum (unat ty)) (unat us) < LENGTH(32)
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 0x10 * slot) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) ` {x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1)} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 0x10 * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 0x10 * slot) s) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> (\<forall>x. unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> unat nodeOffset \<le> unat x \<longrightarrow> slot \<noteq> v0 + x * 0x10) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty)))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (4 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> \<forall>x. unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> unat nodeOffset \<le> unat x \<longrightarrow> slot \<noteq> v0 + x * 0x10
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))
 4. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (4 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s (v0 + x * 0x10) = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' (v0 + x * 0x10) (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w; unat x \<le> unat (nodeOffset + nodeWindow - 1); unat nodeOffset \<le> unat x; slot = v0 + x * 0x10\<rbrakk> \<Longrightarrow> False
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))
 4. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (4 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s (v0 + x * 0x10) = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; descendants_of' (v0 + x * 0x10) (ctes_of s) = {}; unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w; unat x \<le> unat (nodeOffset + nodeWindow - 1); unat nodeOffset \<le> unat x; slot = v0 + x * 0x10; unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + x * 0x10) = Some cte \<and> cteCap cte = capability.NullCap)\<rbrakk> \<Longrightarrow> False
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))
 4. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (3 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))
 3. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' slot (ctes_of s) = {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; range_cover w sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); More_Word_Operations.alignUp w (APIType_capBits (toEnum (unat ty)) (unat us)) = w\<rbrakk> \<Longrightarrow> d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 2 ^ cte_level_bits) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> descendants_of' slot (ctes_of s) \<noteq> {} \<longrightarrow> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) = Some cte \<and> cteCap cte = capability.NullCap)) \<longrightarrow> nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))) \<longrightarrow> (d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped) \<longrightarrow> range_cover (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (getFreeRef w idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) ` {x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1} \<and> distinct (map (\<lambda>x. capCNodePtr nodeCap + 2 ^ cte_level_bits * x) [nodeOffset .e. nodeOffset + nodeWindow - 1]) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (\<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + 2 ^ cte_level_bits * slot) s) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; nodeWindow \<le> 2 ^ capCNodeBits nodeCap - nodeOffset; 1 \<le> nodeWindow; nodeWindow \<le> retypeFanOutLimit; nodeOffset \<le> 2 ^ capCNodeBits nodeCap - 1; nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; nodeOffset \<le> 2 ^ capCNodeBits nodeCap; distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. nodeOffset \<le> x \<and> x \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) \<noteq> {}; \<forall>slot. nodeOffset \<le> slot \<and> slot \<le> nodeOffset + nodeWindow - 1 \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); nodeWindow \<le> word_of_nat (shiftR (2 ^ sz - idx) (APIType_capBits (toEnum (unat ty)) (unat us))); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> (\<forall>x\<le>nodeOffset + nodeWindow - 1. nodeOffset \<le> x \<longrightarrow> slot \<noteq> capCNodePtr nodeCap + x * 0x10) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> 0 < unat nodeWindow \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) \<noteq> {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz - word_of_nat idx >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow) \<and> idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> (\<forall>x. unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> unat nodeOffset \<le> unat x \<longrightarrow> slot \<noteq> capCNodePtr nodeCap + x * 0x10) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) \<noteq> {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz - word_of_nat idx >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w) \<and> More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w \<and> range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow)\<rbrakk> \<Longrightarrow> (\<forall>x. unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> unat nodeOffset \<le> unat x \<longrightarrow> slot \<noteq> capCNodePtr nodeCap + x * 0x10) \<and> (toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat us \<le> maxUntypedSizeBits) \<and> (d \<longrightarrow> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (toEnum (unat ty))) proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2 x. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s (capCNodePtr nodeCap + x * 0x10) = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' (capCNodePtr nodeCap + x * 0x10) (ctes_of s) \<noteq> {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz - word_of_nat idx >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w); More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); unat x \<le> unat (nodeOffset + nodeWindow - 1); unat nodeOffset \<le> unat x; slot = capCNodePtr nodeCap + x * 0x10\<rbrakk> \<Longrightarrow> False
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) \<noteq> {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz - word_of_nat idx >> APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)); idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) - w); More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us))) sz (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) (unat nodeWindow); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; minUntypedSizeBits \<le> unat us\<rbrakk> \<Longrightarrow> unat us \<le> maxUntypedSizeBits proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s (v0 + x * 0x10) = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; descendants_of' (v0 + x * 0x10) (ctes_of s) \<noteq> {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz - word_of_nat idx >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w); More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); unat x \<le> unat (nodeOffset + nodeWindow - 1); unat nodeOffset \<le> unat x; slot = v0 + x * 0x10\<rbrakk> \<Longrightarrow> False
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) \<noteq> {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz - word_of_nat idx >> APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)); idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) - w); More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us))) sz (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) (unat nodeWindow); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; minUntypedSizeBits \<le> unat us\<rbrakk> \<Longrightarrow> unat us \<le> maxUntypedSizeBits proof (prove)
goal (2 subgoals):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' s x2 x v0 v1 v2 v3. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; unat nodeWindow \<le> unat (2 ^ v1 - nodeOffset); unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ v1 - 1); capability.CNodeCap v0 v1 v2 v3 = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> capability.CNodeCap v0 v1 v2 v3 = cteCap cte); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat us; toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat us; APIType_capBits (toEnum (unat ty)) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s (v0 + x * 0x10) = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s v0 of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = v1 \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' (capability.CNodeCap v0 v1 v2 v3) s; unat nodeOffset \<le> unat (2 ^ v1); distinct (map (\<lambda>y. v0 + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; descendants_of' (v0 + x * 0x10) (ctes_of s) \<noteq> {}; unat nodeWindow \<le> unat (2 ^ sz - word_of_nat idx >> APIType_capBits (toEnum (unat ty)) (unat us)); d \<longrightarrow> isFrameType (toEnum (unat ty)) \<or> toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) - w); More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (toEnum (unat ty)) (unat us))) sz (APIType_capBits (toEnum (unat ty)) (unat us)) (unat nodeWindow); unat x \<le> unat (nodeOffset + nodeWindow - 1); unat nodeOffset \<le> unat x; slot = v0 + x * 0x10; unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + x * 0x10) s; unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (v0 + x * 0x10) = Some cte \<and> cteCap cte = capability.NullCap)\<rbrakk> \<Longrightarrow> False
 2. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) \<noteq> {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz - word_of_nat idx >> APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)); idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) - w); More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us))) sz (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) (unat nodeWindow); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; minUntypedSizeBits \<le> unat us\<rbrakk> \<Longrightarrow> unat us \<le> maxUntypedSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>ty us nodeIndexW nodeDepthW nodeOffset nodeWindow rootCap cs' xs' nodeCap s x2. \<lbrakk>args = ty # us # nodeIndexW # nodeDepthW # nodeOffset # nodeWindow # xs'; cs = rootCap # cs'; isCNodeCap nodeCap; unat nodeWindow \<le> unat (2 ^ capCNodeBits nodeCap - nodeOffset); Suc 0 \<le> unat nodeWindow; unat nodeWindow \<le> unat retypeFanOutLimit; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap - 1); nodeCap = rootCap \<or> (\<exists>nodeSlot cte. ctes_of s nodeSlot = Some cte \<and> nodeCap = cteCap cte); APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us) \<le> maxUntypedSizeBits; unat us < wordBits; unat ty \<le> fromEnum maxBound; gen_invocation_type label = UntypedRetype; invs' s; sch_act_simple s; ctes_of s slot = Some (CTE (capability.UntypedCap d w sz idx) x2); valid_cap' rootCap s; \<forall>x\<in>set cs'. valid_cap' x s; \<forall>r\<in>cte_refs' rootCap (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; \<forall>x\<in>set cs'. \<forall>r\<in>cte_refs' x (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s; case gsCNodes s (global.capUntypedPtr nodeCap) of None \<Rightarrow> [nodeOffset .e. nodeOffset + nodeWindow - 1] = [] | Some n \<Rightarrow> \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> n = capCNodeBits nodeCap \<and> x < 2 ^ n; is_aligned w sz; sz < word_bits; idx \<le> 2 ^ sz; 2 ^ sz - idx < 2 ^ word_bits; valid_cap' nodeCap s; unat nodeOffset \<le> unat (2 ^ capCNodeBits nodeCap); distinct (map (\<lambda>y. capCNodePtr nodeCap + y * 0x10) [nodeOffset .e. nodeOffset + nodeWindow - 1]); Suc (unat (nodeOffset + nodeWindow - 1)) = unat nodeOffset + unat nodeWindow; \<forall>x. unat nodeOffset \<le> unat x \<and> unat x \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capCNodePtr nodeCap + x * 0x10) s; descendants_of' slot (ctes_of s) \<noteq> {}; \<forall>slot. unat nodeOffset \<le> unat slot \<and> unat slot \<le> unat (nodeOffset + nodeWindow - 1) \<longrightarrow> (\<exists>cte. ctes_of s (capCNodePtr nodeCap + slot * 0x10) = Some cte \<and> cteCap cte = capability.NullCap); unat nodeWindow \<le> unat (2 ^ sz - word_of_nat idx >> APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)); idx \<le> unat (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) - w); More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) && ~~ mask sz = w; range_cover (More_Word_Operations.alignUp (w + word_of_nat idx) (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us))) sz (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat us)) (unat nodeWindow); toEnum (unat ty) = APIObjectType ArchTypes_H.apiobject_type.Untyped; minUntypedSizeBits \<le> unat us\<rbrakk> \<Longrightarrow> unat us \<le> maxUntypedSizeBits proof (prove)
goal:
No subgoals!